diff --git a/Backport-Fix-CVE-2025-9230.patch b/Backport-Fix-CVE-2025-9230.patch
new file mode 100644
index 0000000000000000000000000000000000000000..500180b56f2b9480626c61b2b815c32705598c62
--- /dev/null
+++ b/Backport-Fix-CVE-2025-9230.patch
@@ -0,0 +1,31 @@
+From a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def Mon Sep 17 00:00:00 2001
+From: Viktor Dukhovni <openssl-users@dukhovni.org>
+Date: Thu, 11 Sep 2025 18:10:12 +0200
+Subject: [PATCH] kek_unwrap_key(): Fix incorrect check of unwrapped key size
+
+Fixes CVE-2025-9230
+
+The check is off by 8 bytes so it is possible to overread by
+up to 8 bytes and overwrite up to 4 bytes.
+
+Reviewed-by: Neil Horman <nhorman@openssl.org>
+Reviewed-by: Matt Caswell <matt@openssl.org>
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+(cherry picked from commit 9c462be2cea54ebfc62953224220b56f8ba22a0c)
+---
+ crypto/cms/cms_pwri.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/cms/cms_pwri.c b/crypto/cms/cms_pwri.c
+index d5c3c8d399dfd..33a7ccaa76a3a 100644
+--- a/crypto/cms/cms_pwri.c
++++ b/crypto/cms/cms_pwri.c
+@@ -229,7 +229,7 @@ static int kek_unwrap_key(unsigned char *out, size_t *outlen,
+         /* Check byte failure */
+         goto err;
+     }
+-    if (inlen < (size_t)(tmp[0] - 4)) {
++    if (inlen < 4 + (size_t)tmp[0]) {
+         /* Invalid length value */
+         goto err;
+     }
diff --git a/openssl.spec b/openssl.spec
index 1f29385a1aa107c6a083556fdc481c4a63a4a45d..80df23eba3797c98957d3e620fb94397856a2bc1 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -2,7 +2,7 @@
 Name:        openssl
 Epoch:       1
 Version:     1.1.1wa
-Release:     11
+Release:     12
 Summary:     Cryptography and SSL/TLS Toolkit
 License:     OpenSSL and SSLeay
 URL:         https://gitee.com/openeuler/openssl
@@ -28,6 +28,7 @@ Patch17:     backport-CVE-2024-5535-Add-a-test-for-ALPN-and-NPN.patch
 Patch18:     backport-Pipeline-output-input-buf-arrays-must-live-until-the.patch
 Patch19:     backport-CVE-2024-9143-Harden-BN_GF2m_poly2arr-against-misuse.patch
 Patch20:     backport-CVE-2024-13176-Fix-timing-side-channel.patch
+Patch21:     Backport-Fix-CVE-2025-9230.patch 
 
 BuildRequires: gcc perl make lksctp-tools-devel coreutils util-linux zlib-devel
 Requires:    coreutils %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -236,6 +237,9 @@ make test || :
 %ldconfig_scriptlets libs
 
 %changelog
+* Wed Oct 1 2025 lizhipeng <lizhipeng@kylinos.cn> - 1:1.1.1wa-12
+- fix CVE-2025-9230
+
 * Wed Feb 5 2025 jinlun <jinlun@huawei.comi> - 1:1.1.1wa-11
 - fix CVE-2024-13176