diff --git a/0004-fix-use-after-free-in-readdir.patch b/0004-fix-use-after-free-in-readdir.patch
new file mode 100644
index 0000000000000000000000000000000000000000..77499da6da48ce5b0b851fa15abeeff056b2e645
--- /dev/null
+++ b/0004-fix-use-after-free-in-readdir.patch
@@ -0,0 +1,46 @@
+From 490e018484efc8db4d00ec6efa72d95c093be575 Mon Sep 17 00:00:00 2001
+From: Rafi KC <rafi.kavungal@iternity.com>
+Date: Tue, 18 Feb 2025 15:34:11 +0530
+Subject: [PATCH] api/glfs: Fix use after free in readdir (#4477)
+
+There is a code path in glfs readdir where we might end up
+using a free'ed memory. A possible case is when we use the
+fd to read the offset 0 after reading the content at least
+once, and the during the second time, the readdir return 0,
+probably due to the contents got deleted.
+
+Change-Id: I08fa6cc9b924b90597ef4498e081cae9339fbd6a
+Fixes: #3955
+
+Signed-off-by: Mohammed Rafi KC <rafi.kavungal@iternity.com>
+---
+ api/src/glfs-fops.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/api/src/glfs-fops.c b/api/src/glfs-fops.c
+index 44b85ab..60bdd63 100644
+--- a/api/src/glfs-fops.c
++++ b/api/src/glfs-fops.c
+@@ -50,6 +50,7 @@ glfs_mark_glfd_for_deletion(struct glfs_fd *glfd)
+     LOCK(&glfd->lock);
+     {
+         glfd->state = GLFD_CLOSE;
++        glfd->next = NULL;
+     }
+     UNLOCK(&glfd->lock);
+ 
+@@ -3747,6 +3748,11 @@ glfd_entry_refresh(struct glfs_fd *glfd, int plus)
+         }
+ 
+         list_splice_init(&glfd->entries, &old.list);
++	/* If glfd->next is non null means, this entry is from the old
++         * list, there is no point in keeping the free'ed data. Hence
++         * set to NULL;
++         */
++        glfd->next = NULL;
+         list_splice_init(&entries.list, &glfd->entries);
+ 
+         /* spurious errno is dangerous for glfd_entry_next() */
+-- 
+2.43.0
+
diff --git a/glusterfs.spec b/glusterfs.spec
index 6daaae5b102db8424d3951c8d2451ed7c824a981..36be1b59f940f0ae5a612fda0bfbdf702897c2aa 100644
--- a/glusterfs.spec
+++ b/glusterfs.spec
@@ -224,7 +224,7 @@
 Summary:          Distributed File System
 Name:             glusterfs
 Version:          10.0
-Release:          9
+Release:          10
 License:          GPLv3 or GPLv2+ or LGPLv3+
 URL:              http://docs.gluster.org/
 %if ( 0%{_for_fedora_koji_builds} )
@@ -240,6 +240,7 @@ Source0:          https://download.gluster.org/pub/gluster/glusterfs/10/10.0/glu
 Patch1:         0001-SC2081-can-t-match-globs-Use-or-grep.patch
 Patch2:         0002-fuse-Resolve-asan-bug-in-during-receive-event-notifi.patch
 Patch3:         0003-dht-fix-asan-use-after-free-bug-4248.patch
+Patch4:         0004-fix-use-after-free-in-readdir.patch
 
 BuildRoot:        %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 BuildRequires:    rpcgen gperftools-devel libunwind-devel
@@ -1522,6 +1523,9 @@ exit 0
 %{_mandir}/man8/*gluster*.8*
 
 %changelog
+* Tue Oct 14 2025 zhangyaqi <zhangyaqi@kylinos.cn> - 10.0-10
+- api/glfs: Fix use after free in readdir
+
 * Tue Mar 12 2024 wuguanghao <wuguanghao3@huawei.com> - 10.0-9
 - fix CVE-2022-48340