diff --git a/backport-fix-tramp-ensure-file-descriptor-is-closed-on-exec.patch b/backport-fix-tramp-ensure-file-descriptor-is-closed-on-exec.patch
new file mode 100644
index 0000000000000000000000000000000000000000..4168ad5ebc3f7bf3b0ed6bc4e689cf8d5bfc1717
--- /dev/null
+++ b/backport-fix-tramp-ensure-file-descriptor-is-closed-on-exec.patch
@@ -0,0 +1,23 @@
+From 60671187688ae3b295ab0e1dd77a8d6dd7a805a2 Mon Sep 17 00:00:00 2001
+From: Anthony Green <green@moxielogic.com>
+Date: Fri, 11 Jul 2025 03:17:18 -0400
+Subject: [PATCH] fix(tramp): ensure file descriptor is closed on exec.  Thanks
+ to Florian Weimer.
+
+c# Please enter the commit message for your changes. Lines starting
+---
+ src/tramp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/tramp.c b/src/tramp.c
+index 8ec084868..31180efb6 100644
+--- a/src/tramp.c
++++ b/src/tramp.c
+@@ -236,7 +236,7 @@ ffi_tramp_get_libffi (void)
+   if (!found)
+     return 0;
+ 
+-  tramp_globals.fd = open (file, O_RDONLY);
++  tramp_globals.fd = open (file, O_RDONLY | O_CLOEXEC);
+   if (tramp_globals.fd == -1)
+     return 0;
diff --git a/libffi.spec b/libffi.spec
index a8b48254ba9c2a369bf1bddb541e934d4f85f620..645cf1a4c9a2f67ebb99949f76e0fb571e3557cb 100644
--- a/libffi.spec
+++ b/libffi.spec
@@ -1,6 +1,6 @@
 Name:		libffi
 Version:	3.5.1
-Release:	1
+Release:	2
 Summary:	A Portable Foreign Function Interface Library
 License:	MIT
 URL:		https://sourceware.org/libffi
@@ -10,6 +10,7 @@ Source2:	ffitarget-multilib.h
 
 Patch1: 	fix-AARCH64EB-support.patch
 Patch2:         libffi-Add-sw64-architecture.patch
+Patch3:         backport-fix-tramp-ensure-file-descriptor-is-closed-on-exec.patch
 
 BuildRequires:	gcc gcc-c++ dejagnu
 BuildRequires:  make
@@ -80,6 +81,9 @@ rm -f $RPM_BUILD_ROOT%{_infodir}/dir
 %{_infodir}/libffi.info*
 
 %changelog
+* Fri Jul 18 2025 liuzhilin <liuzhilin@kylinos.cn> - 3.5.1-2
+- backport fix(tramp): ensure file descriptor is closed on exec
+
 * Thu Jun 12 2025 Funda Wang <fundawang@yeah.net> - 3.5.1-1
 - update to 3.5.1