diff --git a/10_linux-fix-missing-ro-in-kernel-boot-parameters.patch b/10_linux-fix-missing-ro-in-kernel-boot-parameters.patch
new file mode 100644
index 0000000000000000000000000000000000000000..0c4e45923fb3f58a2fe50b501340ffd5c80ea88d
--- /dev/null
+++ b/10_linux-fix-missing-ro-in-kernel-boot-parameters.patch
@@ -0,0 +1,26 @@
+From e072ddcb07cc38aa473901b6800712a7a23a556e Mon Sep 17 00:00:00 2001
+From: Qiumiao Zhang <zhangqiumiao1@huawei.com>
+Date: Thu, 10 Oct 2024 06:55:24 +0000
+Subject: [PATCH] 10_linux: fix missing "ro" in kernel boot parameters
+
+Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
+---
+ util/grub.d/10_linux.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
+index af09e65..eca52ff 100644
+--- a/util/grub.d/10_linux.in
++++ b/util/grub.d/10_linux.in
+@@ -423,7 +423,7 @@ linux_entry ()
+   message="$(gettext_printf "Loading Linux %s ..." ${version})"
+   sed "s/^/$submenu_indentation/" << EOF
+ 	echo	'$(echo "$message" | grub_quote)'
+-	linux	${rel_dirname}/${basename} ${root_device} ${args}
++	linux	${rel_dirname}/${basename} ${root_device} ro ${args}
+ EOF
+   if test -n "${initrd}" ; then
+     # TRANSLATORS: ramdisk isn't identifier. Should be translated.
+-- 
+2.33.0
+
diff --git a/grub.patches b/grub.patches
index cdaa74b60198d3d539a5bede57fefed02befc154..aa7e828c5df8c45849a1e7be8547829e2a77bdf0 100644
--- a/grub.patches
+++ b/grub.patches
@@ -240,3 +240,4 @@ Patch239:       0021-blscfg-add-blscfg-module-to-parse-Boot-Loader-Specif.patch
 Patch240:       0061-Add-BLS-support-to-grub-mkconfig.patch
 Patch241:       0064-Add-grub2-switch-to-blscfg.patch
 Patch242:       0001-newfeature-tpcm-add-hygon-tpcm-support.patch
+Patch243:       10_linux-fix-missing-ro-in-kernel-boot-parameters.patch
diff --git a/grub2.spec b/grub2.spec
index f324e08599a4610dc96a158ff8e26ec67b9a672b..d8305156ba19d65e382a0f1923551646ad9cf5ba 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -1,3 +1,8 @@
+# This package calls binutils components directly and would need to pass
+# in flags to enable the LTO plugins
+# Disable LTO
+%global _lto_cflags %{nil}
+
 %undefine _hardened_build
 
 %global tarversion 2.12
@@ -14,7 +19,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.12
-Release:	24
+Release:	25
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPLv3+
 URL:		http://www.gnu.org/software/grub/
@@ -456,6 +461,13 @@ fi
 %{_datadir}/man/man*
 
 %changelog
+* Thu Oct 10 2024 zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.12-25
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:10_linux: fix missing "ro" in kernel boot parameters
+       Disable LTO
+
 * Fri Aug 2 2024 chench <chench@hygon.cn>  - 1:2.12-24
 - Type:requirement
 - CVE:NA