diff --git a/backport-lsblk-fix-memory-leak.patch b/backport-lsblk-fix-memory-leak.patch
new file mode 100644
index 0000000000000000000000000000000000000000..b79476af21a85660a59ae83d3ee769fae891cada
--- /dev/null
+++ b/backport-lsblk-fix-memory-leak.patch
@@ -0,0 +1,25 @@
+From b13f60104b646b45dc9bf43408e6fdec03382ad9 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Fri, 19 Sep 2025 10:36:33 +0800
+Subject: [PATCH] lsblk: fix memory leak [coverity scan]
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ misc-utils/lsblk.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/misc-utils/lsblk.c b/misc-utils/lsblk.c
+index 0df7962..1fb022b 100644
+--- a/misc-utils/lsblk.c
++++ b/misc-utils/lsblk.c
+@@ -453,6 +453,7 @@ static char *get_type(struct lsblk_device *dev)
+ 
+ 		ul_path_read_string(dev->sysfs, &md_level, "md/level");
+ 		res = (md_level && *md_level) ? md_level : xstrdup("md");
++		free(md_level);
+ 
+ 	} else {
+ 		const char *type = NULL;
+-- 
+2.43.0
+
diff --git a/backport-lsblk-fix-possible-use-after-free.patch b/backport-lsblk-fix-possible-use-after-free.patch
new file mode 100644
index 0000000000000000000000000000000000000000..feed7087f487e1a1e67548bf45f5da63cc7b9851
--- /dev/null
+++ b/backport-lsblk-fix-possible-use-after-free.patch
@@ -0,0 +1,33 @@
+From 02955d9434396df4019132351d8264b74811dc3f Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Fri, 19 Sep 2025 10:38:47 +0800
+Subject: [PATCH] lsblk: fix possible use-after-free
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ misc-utils/lsblk.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/misc-utils/lsblk.c b/misc-utils/lsblk.c
+index 1fb022b..de0c900 100644
+--- a/misc-utils/lsblk.c
++++ b/misc-utils/lsblk.c
+@@ -452,9 +452,12 @@ static char *get_type(struct lsblk_device *dev)
+ 		char *md_level = NULL;
+ 
+ 		ul_path_read_string(dev->sysfs, &md_level, "md/level");
+-		res = (md_level && *md_level) ? md_level : xstrdup("md");
+-		free(md_level);
+-
++		if (md_level && *md_level)
++			res = md_level;
++		else {
++			free(md_level);		/* may be unused empty string */
++			res = xstrdup("md");
++		}
+ 	} else {
+ 		const char *type = NULL;
+ 		int x = 0;
+-- 
+2.43.0
+
diff --git a/util-linux.spec b/util-linux.spec
index 7b8824520bdf158688e1a82950b9d652d089834c..3d1ba40e523b5e1d23dd089ca7d82a66c8967fad 100644
--- a/util-linux.spec
+++ b/util-linux.spec
@@ -3,7 +3,7 @@
 
 Name:           util-linux
 Version:        2.39.1
-Release:        28
+Release:        29
 Summary:        A random collection of Linux utilities
 License:        GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain
 URL:            https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
@@ -118,6 +118,8 @@ Patch6096:      backport-libblkid-topology-ioctl-correctly-handle-kernel-type.pa
 Patch6097:      backport-libmount-fix-umount-read-only.patch
 Patch6098:      backport-libsmartcols-fix-reduction-stages-use.patch
 Patch6099:      backport-lsblk-use-md-as-fallback-TYPE-when-md-level-empty.patch
+Patch6100:      backport-lsblk-fix-memory-leak.patch
+Patch6101:      backport-lsblk-fix-possible-use-after-free.patch
 
 Patch9000:      SKIPPED-no-root-permissions-test.patch
 Patch9001:      util-linux-Add-sw64-architecture.patch
@@ -484,6 +486,13 @@ fi
 %endif
 
 %changelog
+* Fri Sep 19 2025 cenhuilin <cenhuilin@kylinos.cn> - 2.39.1-29
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:lsblk: fix memory leak [coverity scan]
+       lsblk: fix possible use-after-free
+
 * Wed Sep 17 2025 zhangfeilong <zhangfeilong@uniontech.com> - 2.39.1-28
 - fix sw64 build.