diff --git a/glibc.spec b/glibc.spec
index 2611e1b54bd75c9146b6c860e378c2a9178cc175..89df5bc2bb41d37cd4830ab686421786fa1c81ac 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -62,7 +62,7 @@
 ##############################################################################
 Name: 	 	glibc
 Version: 	2.28
-Release: 	111
+Release: 	112
 Summary: 	The GNU libc libraries
 License:	%{all_license}
 URL: 		http://www.gnu.org/software/glibc/
@@ -180,6 +180,7 @@ Patch93: backport-0003-posix-Falling-back-to-non-wide-mode-in-case-of-encod.patc
 Patch94: backport-0004-posix-Remove-alloca-usage-for-internal-fnmatch-imple.patch
 Patch95: posix-Fix-double-free-after-allocation-failure-in-re.patch
 Patch96: benchtests-Set-float-type-on-threshold-argument.patch
+Patch97: stdio-Fix-aliasing-violation.patch
 
 Provides: ldconfig rtld(GNU_HASH) bundled(gnulib)
 
@@ -1297,6 +1298,9 @@ fi
 %endif
 
 %changelog
+* Thu Aug 07 2025 panzhe <panzhe@kylinos.cn> - 2.28-112
+- stdio: Fix aliasing violation
+
 * Tue Aug 05 2025 panzhe <panzhe@kylinos.cn> - 2.28-111
 - benchtests: Set float type on --threshold argument
 
diff --git a/stdio-Fix-aliasing-violation.patch b/stdio-Fix-aliasing-violation.patch
new file mode 100644
index 0000000000000000000000000000000000000000..d8ff77c6029b4bbcb0a432085b59d17188bb503d
--- /dev/null
+++ b/stdio-Fix-aliasing-violation.patch
@@ -0,0 +1,91 @@
+From c0e9ddf59e73e21afe15fca4e94cf7b4b7359bf2 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@suse.de>
+Date: Thu, 1 Oct 2020 13:59:13 +0200
+Subject: [PATCH] __vfscanf_internal: fix aliasing violation (bug 26690)
+
+As noted in <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97264>, the cast
+in the call to the read_int function is an aliasing violation.  Change the
+type of local variable f to a pointer to unsigned, which allows to
+eliminate most casts while only adding three new ones.
+
+---
+ stdio-common/vfscanf.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/stdio-common/vfscanf.c b/stdio-common/vfscanf.c
+index 1ce836a3..dd745e4b 100644
+--- a/stdio-common/vfscanf.c
++++ b/stdio-common/vfscanf.c
+@@ -276,7 +276,7 @@ _IO_vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ #endif
+ {
+   va_list arg;
+-  const CHAR_T *f = format;
++  const UCHAR_T *f = (const UCHAR_T *) format;
+   UCHAR_T fc;	/* Current character of the format.  */
+   WINT_T done = 0;	/* Assignments done.  */
+   size_t read_in = 0;	/* Chars read in.  */
+@@ -415,10 +415,11 @@ _IO_vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ #endif
+ 
+ #ifndef COMPILE_WSCANF
+-      if (!isascii ((unsigned char) *f))
++      if (!isascii (*f))
+ 	{
+ 	  /* Non-ASCII, may be a multibyte.  */
+-	  int len = __mbrlen (f, strlen (f), &state);
++	  int len = __mbrlen ((const char *) f, strlen ((const char *) f),
++			      &state);
+ 	  if (len > 0)
+ 	    {
+ 	      do
+@@ -426,7 +427,7 @@ _IO_vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 		  c = inchar ();
+ 		  if (__glibc_unlikely (c == EOF))
+ 		    input_error ();
+-		  else if (c != (unsigned char) *f++)
++		  else if (c != *f++)
+ 		    {
+ 		      ungetc_not_eof (c, s);
+ 		      conv_error ();
+@@ -484,9 +485,9 @@ _IO_vfscanf_internal (FILE *s, const char *format, va_list argptr,
+       char_buffer_rewind (&charbuf);
+ 
+       /* Check for a positional parameter specification.  */
+-      if (ISDIGIT ((UCHAR_T) *f))
++      if (ISDIGIT (*f))
+ 	{
+-	  argpos = read_int ((const UCHAR_T **) &f);
++	  argpos = read_int (&f);
+ 	  if (*f == L_('$'))
+ 	    ++f;
+ 	  else
+@@ -521,8 +522,8 @@ _IO_vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 
+       /* Find the maximum field width.  */
+       width = 0;
+-      if (ISDIGIT ((UCHAR_T) *f))
+-	width = read_int ((const UCHAR_T **) &f);
++      if (ISDIGIT (*f))
++	width = read_int (&f);
+     got_width:
+       if (width == 0)
+ 	width = -1;
+@@ -2510,12 +2511,11 @@ _IO_vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 	    }
+ 
+ 	  while ((fc = *f++) != '\0' && fc != ']')
+-	    if (fc == '-' && *f != '\0' && *f != ']'
+-		&& (unsigned char) f[-2] <= (unsigned char) *f)
++	    if (fc == '-' && *f != '\0' && *f != ']' && f[-2] <= *f)
+ 	      {
+ 		/* Add all characters from the one before the '-'
+ 		   up to (but not including) the next format char.  */
+-		for (fc = (unsigned char) f[-2]; fc < (unsigned char) *f; ++fc)
++		for (fc = f[-2]; fc < *f; ++fc)
+ 		  ((char *)charbuf.scratch.data)[fc] = 1;
+ 	      }
+ 	    else
+-- 
+2.25.1
+