diff --git a/backport-xtables-eb-fix-crash-when-opts-isn-t-reallocated.patch b/backport-xtables-eb-fix-crash-when-opts-isn-t-reallocated.patch
new file mode 100644
index 0000000000000000000000000000000000000000..71dc49b0596fd14b23e14322433edeb4da6f9295
--- /dev/null
+++ b/backport-xtables-eb-fix-crash-when-opts-isn-t-reallocated.patch
@@ -0,0 +1,32 @@
+From e900d40afdb731d2270a5110833ae49192974355 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Tue, 14 Mar 2023 22:36:50 +0100
+Subject: [PATCH] xtables-eb: fix crash when opts isn't reallocated
+
+opts may point to statically allocated memory.
+This fixes abort() from libc.
+
+Conflict: NA
+Reference: https://git.netfilter.org/iptables/commit?id=e900d40afdb731d2270a5110833ae49192974355
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+---
+ iptables/xtables-eb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index 3a73e797..068dffd2 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -675,7 +675,8 @@ void nft_fini_eb(struct nft_handle *h)
+ 		free(target->t);
+ 	}
+ 
+-	free(opts);
++	if (opts != ebt_original_options)
++		free(opts);
+ 
+ 	nft_fini(h);
+ 	xtables_fini();
+-- 
+2.23.0
diff --git a/iptables.spec b/iptables.spec
index 4a2667ee6594d4071b0afdd3d0f4fb617c7fb78f..bc6301bbe5b9d92522a3d1aaecf545067e10382a 100644
--- a/iptables.spec
+++ b/iptables.spec
@@ -2,7 +2,7 @@
 %global legacy_actions %{_libexecdir}/initscripts/legacy-actions
 Name:		  iptables
 Version:	  1.8.7
-Release:	  12
+Release:	  13
 Summary:	  IP packet filter administration utilities
 License:	  GPLv2 and Artistic Licence 2.0 and ISC
 URL:		  https://www.netfilter.org/
@@ -31,6 +31,8 @@ Patch13:          backport-nft-Plug-memleak-in-nft_rule_zero_counters.patch
 Patch14:          backport-iptables-Plug-memleaks-in-print_firewall.patch
 Patch15:          backport-ebtables-translate-Print-flush-command-after-parsing-is-finished.patch
 
+Patch16:          backport-xtables-eb-fix-crash-when-opts-isn-t-reallocated.patch
+
 BuildRequires:    bison flex gcc kernel-headers libpcap-devel libselinux-devel systemd
 BuildRequires:    libmnl-devel libnetfilter_conntrack-devel libnfnetlink-devel libnftnl-devel
 BuildRequires:    autogen autoconf automake libtool
@@ -338,6 +340,12 @@ fi
 %{_mandir}/man8/xtables-legacy*
 
 %changelog
+* Wed Apr 12 2023 zhanghao <zhanghao383@huawei.com> - 1.8.7-13
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:xtables-eb: fix crash when opts isn't reallocated
+
 * Tue Mar 21 2023 zhanghao <zhanghao383@huawei.com> - 1.8.7-12
 - Type:bugfix
 - CVE:NA