diff --git a/backport-0027-CVE-2025-8114-Fix-NULL-pointer-dereference-after-allocation-failure.patch b/backport-0027-CVE-2025-8114-Fix-NULL-pointer-dereference-after-allocation-failure.patch
new file mode 100644
index 0000000000000000000000000000000000000000..04f367c8075211d51e2a4cf1e2be760d4b39a236
--- /dev/null
+++ b/backport-0027-CVE-2025-8114-Fix-NULL-pointer-dereference-after-allocation-failure.patch
@@ -0,0 +1,43 @@
+From 53ac23ded4cb2c5463f6c4cd1525331bd578812d Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@cryptomilk.org>
+Date: Wed, 6 Aug 2025 15:17:59 +0200
+Subject: CVE-2025-8114: Fix NULL pointer dereference after allocation failure
+
+Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
+Reviewed-by: Jakub Jelen <jjelen@redhat.com>
+---
+ src/kex.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/kex.c b/src/kex.c
+index f1c1b014..02f2735f 100644
+--- a/src/kex.c
++++ b/src/kex.c
+@@ -1569,6 +1569,8 @@ int ssh_make_sessionid(ssh_session session)
+     ssh_log_hexdump("hash buffer", ssh_buffer_get(buf), ssh_buffer_get_len(buf));
+ #endif
+ 
++    /* Set rc for the following switch statement in case we goto error. */
++    rc = SSH_ERROR;
+     switch (session->next_crypto->kex_type) {
+     case SSH_KEX_DH_GROUP1_SHA1:
+     case SSH_KEX_DH_GROUP14_SHA1:
+@@ -1629,6 +1631,7 @@ int ssh_make_sessionid(ssh_session session)
+                session->next_crypto->secret_hash);
+         break;
+     }
++
+     /* During the first kex, secret hash and session ID are equal. However, after
+      * a key re-exchange, a new secret hash is calculated. This hash will not replace
+      * but complement existing session id.
+@@ -1637,6 +1640,7 @@ int ssh_make_sessionid(ssh_session session)
+         session->next_crypto->session_id = malloc(session->next_crypto->digest_len);
+         if (session->next_crypto->session_id == NULL) {
+             ssh_set_error_oom(session);
++            rc = SSH_ERROR;
+             goto error;
+         }
+         memcpy(session->next_crypto->session_id, session->next_crypto->secret_hash,
+-- 
+cgit v1.2.3
+
diff --git a/libssh.spec b/libssh.spec
index 95a8444846d22b1bf4e55c517025c4bc9982d97a..b378f9ccb512f7780223282ed874d0a64d18e031 100644
--- a/libssh.spec
+++ b/libssh.spec
@@ -1,6 +1,6 @@
 Name:           libssh
 Version:        0.9.4
-Release:        11
+Release:        12
 Summary:        A library implementing the SSH protocol
 License:        LGPLv2+
 URL:            http://www.libssh.org
@@ -56,6 +56,7 @@ Patch44:        backport-CVE-2025-4878-fix-uninitialized-variable-part1.patch
 Patch45:        backport-CVE-2025-4878-fix-uninitialized-variable-part2.patch
 Patch46:        backport-CVE-2025-5372-pre-Reformat-ssh_kdf.patch
 Patch47:        backport-CVE-2025-5372-Simplify-error-checking-in-ssh_kdf.patch
+Patch48:	backport-0027-CVE-2025-8114-Fix-NULL-pointer-dereference-after-allocation-failure.patch
 
 BuildRequires:  cmake gcc-c++ gnupg2 openssl-devel pkgconfig zlib-devel
 BuildRequires:  krb5-devel libcmocka-devel openssh-clients openssh-server
@@ -140,6 +141,9 @@ popd
 %doc ChangeLog README
 
 %changelog
+* Wed Sep 10 2025 Zhang Yi <yizhang@cqsoftware.com.cn> - 0.9.4-12
+- fix CVE-2025-8114
+
 * Wed Aug 27 2025 gaihuiying <eaglegai@163.com> - 0.9.4-11
 - Type:CVE
 - CVE:CVE-2025-4877 CVE-2025-4878 CVE-2025-5372