diff --git a/libvirt.spec b/libvirt.spec
index a25367ad1caf217a92fdbe84dd5c1f5b63f8d838..3f2ba78844b5ab57f1cda15a2fe08d7712b4ca2e 100644
--- a/libvirt.spec
+++ b/libvirt.spec
@@ -99,7 +99,7 @@
 Summary: Library providing a simple virtualization API
 Name: libvirt
 Version: 6.2.0
-Release: 10
+Release: 11
 License: LGPLv2+
 URL: https://libvirt.org/
 
@@ -137,6 +137,8 @@ Patch0026: rpc-require-write-acl-for-guest-agent-in-virDomainIn.patch
 Patch0027: qemu-agent-set-ifname-to-NULL-after-freeing.patch
 Patch0028: util-Move-virIsDevMapperDevice-to-virdevmapper.c.patch
 Patch0029: virdevmapper-Don-t-use-libdevmapper-to-obtain-depend.patch
+Patch0030: storage_driver-Unlock-object-on-ACL-fail-in-storageP.patch
+Patch0031: security-fix-SELinux-label-generation-logic.patch
 
 Requires: libvirt-daemon = %{version}-%{release}
 Requires: libvirt-daemon-config-network = %{version}-%{release}
@@ -1869,6 +1871,10 @@ exit 0
 
 
 %changelog
+* Sun Sep 26 2021 Euler Robot <euler.robot@huawei.com>
+- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
+- security: fix SELinux label generation logic
+
 * Wed Jan 20 2021 Huawei Technologies Co., Ltd <alex.chen@huawei.com>
 - util: Move virIsDevMapperDevice() to virdevmapper.c
 - virdevmapper: Don't use libdevmapper to obtain dependencies
diff --git a/security-fix-SELinux-label-generation-logic.patch b/security-fix-SELinux-label-generation-logic.patch
new file mode 100644
index 0000000000000000000000000000000000000000..6895bc950218624bbf181dd086326122d73cfd6e
--- /dev/null
+++ b/security-fix-SELinux-label-generation-logic.patch
@@ -0,0 +1,54 @@
+From 2fe07f1800886ce77164417661aafacee11e2841 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Mon, 28 Jun 2021 13:09:04 +0100
+Subject: [PATCH] security: fix SELinux label generation logic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A process can access a file if the set of MCS categories
+for the file is equal-to *or* a subset-of, the set of
+MCS categories for the process.
+
+If there are two VMs:
+
+  a) svirt_t:s0:c117
+  b) svirt_t:s0:c117,c720
+
+Then VM (b) is able to access files labelled for VM (a).
+
+IOW, we must discard case where the categories are equal
+because that is a subset of many other valid category pairs.
+
+Fixes: https://gitlab.com/libvirt/libvirt/-/issues/153
+CVE-2021-3631
+Reviewed-by: Peter Krempa <pkrempa@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+---
+ src/security/security_selinux.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
+index 72d1658e05..f1281b9cc0 100644
+--- a/src/security/security_selinux.c
++++ b/src/security/security_selinux.c
+@@ -391,7 +391,15 @@ virSecuritySELinuxMCSFind(virSecurityManagerPtr mgr,
+         VIR_DEBUG("Try cat %s:c%d,c%d", sens, c1 + catMin, c2 + catMin);
+ 
+         if (c1 == c2) {
+-            mcs = g_strdup_printf("%s:c%d", sens, catMin + c1);
++            /*
++             * A process can access a file if the set of MCS categories
++             * for the file is equal-to *or* a subset-of, the set of
++             * MCS categories for the process.
++             *
++             * IOW, we must discard case where the categories are equal
++             * because that is a subset of other category pairs.
++             */
++            continue;
+         } else {
+             if (c1 > c2) {
+                 int t = c1;
+-- 
+2.27.0
+
diff --git a/storage_driver-Unlock-object-on-ACL-fail-in-storageP.patch b/storage_driver-Unlock-object-on-ACL-fail-in-storageP.patch
new file mode 100644
index 0000000000000000000000000000000000000000..7d339109441d56b281fa8bfc34008aa4f007038d
--- /dev/null
+++ b/storage_driver-Unlock-object-on-ACL-fail-in-storageP.patch
@@ -0,0 +1,36 @@
+From a8e124701eee4616c8b54934c125fd12df6f9ac7 Mon Sep 17 00:00:00 2001
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 21 Jul 2021 11:22:25 +0200
+Subject: [PATCH] storage_driver: Unlock object on ACL fail in
+ storagePoolLookupByTargetPath
+
+'virStoragePoolObjListSearch' returns a locked and refed object, thus we
+must release it on ACL permission failure.
+
+Fixes: 7aa0e8c0cb8
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1984318
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/storage/storage_driver.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c
+index 2db763caa5..d52d537152 100644
+--- a/src/storage/storage_driver.c
++++ b/src/storage/storage_driver.c
+@@ -1740,8 +1740,10 @@ storagePoolLookupByTargetPath(virConnectPtr conn,
+                                            storagePoolLookupByTargetPathCallback,
+                                            cleanpath))) {
+         def = virStoragePoolObjGetDef(obj);
+-        if (virStoragePoolLookupByTargetPathEnsureACL(conn, def) < 0)
++        if (virStoragePoolLookupByTargetPathEnsureACL(conn, def) < 0) {
++            virStoragePoolObjEndAPI(&obj);
+             return NULL;
++        }
+ 
+         pool = virGetStoragePool(conn, def->name, def->uuid, NULL, NULL);
+         virStoragePoolObjEndAPI(&obj);
+-- 
+2.27.0
+