diff --git a/0405-Add-a-recursion-limit-to-the-demangle_const-function.patch b/0405-Add-a-recursion-limit-to-the-demangle_const-function.patch
new file mode 100644
index 0000000000000000000000000000000000000000..bcffa3950bddaafaabe87c0f973baa9d243605c3
--- /dev/null
+++ b/0405-Add-a-recursion-limit-to-the-demangle_const-function.patch
@@ -0,0 +1,74 @@
+diff --git a/libiberty/rust-demangle.c b/libiberty/rust-demangle.c
+index 3b24d63892a..d601182ac50 100644
+--- a/libiberty/rust-demangle.c
++++ b/libiberty/rust-demangle.c
+@@ -126,7 +126,7 @@ parse_integer_62 (struct rust_demangler *rdm)
+     return 0;
+ 
+   x = 0;
+-  while (!eat (rdm, '_'))
++  while (!eat (rdm, '_') && !rdm->errored)
+     {
+       c = next (rdm);
+       x *= 62;
+@@ -1148,6 +1148,15 @@ demangle_const (struct rust_demangler *rdm)
+   if (rdm->errored)
+     return;
+ 
++  if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
++    {
++      ++ rdm->recursion;
++      if (rdm->recursion > RUST_MAX_RECURSION_COUNT)
++	/* FIXME: There ought to be a way to report
++	   that the recursion limit has been reached.  */
++	goto fail_return;
++    }
++  
+   if (eat (rdm, 'B'))
+     {
+       backref = parse_integer_62 (rdm);
+@@ -1158,7 +1167,7 @@ demangle_const (struct rust_demangler *rdm)
+           demangle_const (rdm);
+           rdm->next = old_next;
+         }
+-      return;
++      goto pass_return;
+     }
+ 
+   ty_tag = next (rdm);
+@@ -1167,7 +1176,7 @@ demangle_const (struct rust_demangler *rdm)
+     /* Placeholder. */
+     case 'p':
+       PRINT ("_");
+-      return;
++      goto pass_return;
+ 
+     /* Unsigned integer types. */
+     case 'h':
+@@ -1200,18 +1209,20 @@ demangle_const (struct rust_demangler *rdm)
+       break;
+ 
+     default:
+-      rdm->errored = 1;
+-      return;
++      goto fail_return;
+     }
+ 
+-  if (rdm->errored)
+-    return;
+-
+-  if (rdm->verbose)
++  if (!rdm->errored && rdm->verbose)
+     {
+       PRINT (": ");
+       PRINT (basic_type (ty_tag));
+     }
++
++ fail_return:
++  rdm->errored = 1;
++ pass_return:
++  if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
++    -- rdm->recursion;
+ }
+ 
+ static void
diff --git a/gcc.spec b/gcc.spec
index b35337d77b2d6954ca0ff65e218aa405272f4801..cf3e4eb26f026289e387730e222ab46ccdb224df 100644
--- a/gcc.spec
+++ b/gcc.spec
@@ -2,7 +2,7 @@
 %global gcc_major 12
 # Note, gcc_release must be integer, if you want to add suffixes to
 # %%{release}, append them after %%{gcc_release} on Release: line.
-%global gcc_release 104
+%global gcc_release 105
 
 %global _unpackaged_files_terminate_build 0
 %global _performance_build 1
@@ -514,6 +514,7 @@ Patch401: 0401-testsuite-Fix-up-g-.dg-ext-int128-8.C-testcase-PR109.patch
 Patch402: 0402-c-fix-unsigned-typedef-name-extension-PR108099.patch
 Patch403: 0403-Add-loop-sve-mode-optimization.patch 
 Patch404: 0404-FIX-aarch64-align-arch-name-offset-in-aarch64-_core.patch
+Patch405: 0405-Add-a-recursion-limit-to-the-demangle_const-function.patch
 
 
 # Part 1001-1999
@@ -1768,6 +1769,7 @@ not stable, so plugins must be rebuilt any time GCC is updated.
 %patch -P402 -p1
 %patch -P403 -p1
 %patch -P404 -p1
+%patch -P405 -p1
 
 %ifarch sw_64
 %patch -P1001 -p1
@@ -4457,6 +4459,10 @@ end
 %doc rpm.doc/changelogs/libcc1/ChangeLog*
 
 %changelog
+* Mon Dec 22 2025 huzife <634763349@qq.com> - 12.3.1-105
+- Type: Bugfix
+- DESC: Fix CVE-2022-27943
+
 * Mon Dec 1 2025 swcompiler <lc@wxiat.com> - 12.3.1-104
 - Type: Sw64
 - DESC: