diff --git a/0006-dont_allow_suid_and_dev_set_on_fs_resize.patch b/0006-dont_allow_suid_and_dev_set_on_fs_resize.patch
new file mode 100644
index 0000000000000000000000000000000000000000..90d4d69da4aebc5ba00ed7ba1fbda9fbc67d2cb3
--- /dev/null
+++ b/0006-dont_allow_suid_and_dev_set_on_fs_resize.patch
@@ -0,0 +1,25 @@
+From 46b54414f66e965e3c37f8f51e621f96258ae22e Mon Sep 17 00:00:00 2001
+From: Thomas Blume <Thomas.Blume@suse.com>
+Date: Fri, 16 May 2025 14:27:10 +0200
+Subject: [PATCH] Don't allow suid and dev set on fs resize
+
+Fixes: CVE-2025-6019
+[Shile Zhang: Backport from 3.2.0 to 2.28, commit 46b54414f]
+https://github.com/storaged-project/libblockdev/commit/46b54414f66e965e3c37f8f51e621f96258ae22e
+---
+ src/plugins/fs/generic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/plugins/fs/generic.c b/src/plugins/fs/generic.c
+index 69333944..4a0c7cf8 100644
+--- a/src/plugins/fs/generic.c
++++ b/src/plugins/fs/generic.c
+@@ -409,7 +409,7 @@ static gboolean xfs_resize_device (const gchar *device, guint64 new_size,
+                              "before resizing it.", device);
+                 return FALSE;
+             }
+-            ret = bd_fs_mount (device, mountpoint, "xfs", NULL, NULL, error);
++            ret = bd_fs_mount (device, mountpoint, "xfs", "nosuid,nodev", NULL, error);
+             if (!ret) {
+                 g_prefix_error (error, "Failed to mount '%s' before resizing it: ", device);
+                 return FALSE;
diff --git a/libblockdev.spec b/libblockdev.spec
index 8143b0e0bb998091e8fa4f40e97731d0b04dbad9..4493cd9ca3c1e6431e2deaa0d6e474311b919023 100644
--- a/libblockdev.spec
+++ b/libblockdev.spec
@@ -125,7 +125,7 @@
 
 Name:        libblockdev
 Version:     2.28
-Release:     6%{?dist}
+Release:     7%{?dist}
 Summary:     A library for low-level manipulation with block devices
 License:     LGPLv2+
 URL:         https://github.com/storaged-project/libblockdev
@@ -135,6 +135,7 @@ Patch1:      0002-tests-Fix-test_swapon_pagesize-on-systems-with-64k-p.patch
 Patch2:      0003-part-Fix-segfault-when-adding-a-partition-too-big-fo.patch
 Patch3:      0004-lvm-Add-a-function-to-activate-LVs-in-shared-mode.patch
 Patch4:      0005-lvm-Add-support-for-starting-and-stopping-VG-locking.patch
+Patch5:      0006-dont_allow_suid_and_dev_set_on_fs_resize.patch
 
 BuildRequires: make
 BuildRequires: glib2-devel
@@ -991,6 +992,9 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm}
 %files plugins-all
 
 %changelog
+* Mon Jun 23 2025 Shile Zhang<shile.zhang@linux.alibaba.com> - 2.28-7
+- fix CVE-2025-6019
+
 * Wed Nov 08 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-10
 - lvm: Add support for starting and stopping VG locking
   Resolves: RHEL-15923