diff --git a/CVE-2026-19411.patch b/CVE-2026-19411.patch
new file mode 100644
index 0000000000000000000000000000000000000000..ddb1d130675f98cea70ff4dd83125c2e16fe279b
--- /dev/null
+++ b/CVE-2026-19411.patch
@@ -0,0 +1,27 @@
+From: PengLAI Code <rel-eng@openanolis.org>
+Date: Sat, 29 Aug 2026 05:09:32 +0000
+Subject: [PATCH] Fix CVE-2026-19411 in shim
+
+CVE: CVE-2026-19411
+Bug: CVE-2026-19411
+
+---
+ shim.c |   5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/shim.c b/shim.c
+--- a/shim.c
++++ b/shim.c
+@@ -767,7 +767,12 @@
+ 	CHAR16 *bootpath = NULL;
+ 	int ret = 0;
+
++	if (li == NULL || li->FilePath == NULL)
++		return 0;
++
+ 	bootpath = DevicePathToStr(li->FilePath);
++	if (bootpath == NULL)
++		return 0;
+
+ 	/* Check the beginning of the string and the end, to avoid
+ 	 * caring about which arch this is. */
diff --git a/shim.spec b/shim.spec
index 658c261f288f9e26968b77cd60d363153b8ace5a..047c56d9fdb080ce86c98bab48aaf43b88cbe683 100644
--- a/shim.spec
+++ b/shim.spec
@@ -1,4 +1,4 @@
-%define anolis_release 3
+%define anolis_release 4
 
 %global grub_version 2.06
 %global fwupd_version 1.5.8
@@ -47,6 +47,9 @@ Patch0006:	fix-CVE-2023-40549.patch
 Patch0007:	fix-CVE-2023-40550.patch
 # https://github.com/rhboot/shim/commit/5a5147d1e19cf90ec280990c84061ac3f67ea1ab
 Patch0008:	fix-CVE-2023-40551.patch
+# CVE-2026-19411
+# Source: anolis
+Patch0009: CVE-2026-19411.patch
 
 BuildRequires:  efi-filesystem
 BuildRequires:  efi-srpm-macros >= 5
@@ -174,6 +177,10 @@ install -m 0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/dnf/protected.d/
 %files debugsource -f build-%{efiarch}/debugsource.list
 
 %changelog
+* Sat Aug 29 2026 PengLAI Code <rel-eng@openanolis.org> - 15.7-4
+- Fix CVE-2026-19411
+- Patch generated by PengLAI Code Agent
+
 * Tue Aug 19 2025 wenxin <wx02272781@alibaba-inc.com> - 15.7-3
 - Add patch to fix CVEs
 - fix CVE-2023-40546