diff --git a/backport-lsblk-fix-memory-leak.patch b/backport-lsblk-fix-memory-leak.patch
new file mode 100644
index 0000000000000000000000000000000000000000..0974aece1d66397cffad311bb74b4e474999692e
--- /dev/null
+++ b/backport-lsblk-fix-memory-leak.patch
@@ -0,0 +1,25 @@
+From b13f60104b646b45dc9bf43408e6fdec03382ad9 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Fri, 19 Sep 2025 10:04:20 +0800
+Subject: [PATCH] lsblk: fix memory leak [coverity scan]
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ misc-utils/lsblk.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/misc-utils/lsblk.c b/misc-utils/lsblk.c
+index c3b97d9..d1f962c 100644
+--- a/misc-utils/lsblk.c
++++ b/misc-utils/lsblk.c
+@@ -483,6 +483,7 @@ static char *get_type(struct lsblk_device *dev)
+ 
+ 		ul_path_read_string(dev->sysfs, &md_level, "md/level");
+ 		res = (md_level && *md_level) ? md_level : xstrdup("md");
++		free(md_level);
+ 
+ 	} else {
+ 		const char *type = NULL;
+-- 
+2.43.0
+
diff --git a/backport-lsblk-fix-possible-use-after-free.patch b/backport-lsblk-fix-possible-use-after-free.patch
new file mode 100644
index 0000000000000000000000000000000000000000..8a28141d10a175a903f799c403022941607cdaef
--- /dev/null
+++ b/backport-lsblk-fix-possible-use-after-free.patch
@@ -0,0 +1,33 @@
+From 02955d9434396df4019132351d8264b74811dc3f Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Fri, 19 Sep 2025 10:08:59 +0800
+Subject: [PATCH] lsblk: fix possible use-after-free
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ misc-utils/lsblk.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/misc-utils/lsblk.c b/misc-utils/lsblk.c
+index d1f962c..cc44b91 100644
+--- a/misc-utils/lsblk.c
++++ b/misc-utils/lsblk.c
+@@ -482,9 +482,12 @@ static char *get_type(struct lsblk_device *dev)
+ 		char *md_level = NULL;
+ 
+ 		ul_path_read_string(dev->sysfs, &md_level, "md/level");
+-		res = (md_level && *md_level) ? md_level : xstrdup("md");
+-		free(md_level);
+-
++		if (md_level && *md_level)
++			res = md_level;
++		else {
++			free(md_level);		/* may be unused empty string */
++			res = xstrdup("md");
++		}
+ 	} else {
+ 		const char *type = NULL;
+ 		int x = 0;
+-- 
+2.43.0
+
diff --git a/util-linux.spec b/util-linux.spec
index b91462d94d7c2934b3793b759cfe092db036e7ff..0d64f88a8ef42a3152b3683d563c5e64c21f3e6f 100644
--- a/util-linux.spec
+++ b/util-linux.spec
@@ -3,7 +3,7 @@
 
 Name:           util-linux
 Version:        2.40.4
-Release:        10
+Release:        11
 Summary:        A random collection of Linux utilities
 License:        GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain
 URL:            https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
@@ -43,6 +43,8 @@ Patch6021:      backport-swapoff-clean-up-tag-resolution.patch
 Patch6022:      backport-libblkid-befs-fix-underflow.patch
 Patch6023:      backport-revert-libblkid-ext-add-checksum-support.patch
 Patch6024:      backport-lsblk-use-md-as-fallback-TYPE-when-md-level-empty.patch
+Patch6025:      backport-lsblk-fix-memory-leak.patch
+Patch6026:      backport-lsblk-fix-possible-use-after-free.patch
 
 Patch9000:      SKIPPED-no-root-permissions-test.patch
 Patch9001:      util-linux-Add-sw64-architecture.patch
@@ -410,6 +412,13 @@ fi
 %endif
 
 %changelog
+* Fri Sep 19 2025 cenhuilin <cenhuilin@kylinos.cn> - 2.40.4-11
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:lsblk: fix memory leak [coverity scan]
+       lsblk: fix possible use-after-free
+
 * Tue Sep 02 2025 cenhuilin <cenhuilin@kylinos.cn> - 2.40.4-10
 - Type:bugfix
 - CVE:NA