diff --git a/0099-libhns-Fix-double-free-of-rinl_buf-wqe_list.patch b/0099-libhns-Fix-double-free-of-rinl_buf-wqe_list.patch
new file mode 100755
index 0000000000000000000000000000000000000000..ecfb67584804e7f2d45d0b45e1e67b8cece1b30e
--- /dev/null
+++ b/0099-libhns-Fix-double-free-of-rinl_buf-wqe_list.patch
@@ -0,0 +1,41 @@
+From 74d4bf703183fd19147fb03abfd9ba1430598c3d Mon Sep 17 00:00:00 2001
+From: wenglianfa <wenglianfa@huawei.com>
+Date: Mon, 26 May 2025 21:20:29 +0800
+Subject: [PATCH] create patch
+
+---
+ providers/hns/hns_roce_u_verbs.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c
+index 7418d2c6..277e906c 100644
+--- a/providers/hns/hns_roce_u_verbs.c
++++ b/providers/hns/hns_roce_u_verbs.c
+@@ -1658,18 +1658,21 @@ static int qp_alloc_wqe(struct ibv_qp_init_attr_ex *attr,
+ 		qp->dca_wqe.shift = qp->pageshift;
+ 		qp->dca_wqe.bufs = calloc(qp->dca_wqe.max_cnt, sizeof(void *));
+ 		if (!qp->dca_wqe.bufs)
+-			goto err_alloc;
++			goto err_alloc_recv_rinl_buf;
+ 		verbs_debug(&ctx->ibv_ctx, "alloc DCA buf.\n");
+ 	} else {
+ 		if (hns_roce_alloc_buf(&qp->buf, qp->buf_size,
+ 				       1 << qp->pageshift))
+-			goto err_alloc;
++			goto err_alloc_recv_rinl_buf;
+ 	}
++	if (hns_roce_alloc_buf(&qp->buf, qp->buf_size, HNS_HW_PAGE_SIZE))
++		goto err_alloc_recv_rinl_buf;
+ 
+ 	return 0;
+ 
+-err_alloc:
++err_alloc_recv_rinl_buf:
+ 	free_recv_rinl_buf(&qp->rq_rinl_buf);
++err_alloc:
+ 	if (qp->rq.wrid)
+ 		free(qp->rq.wrid);
+ 
+-- 
+2.43.0
+
diff --git a/rdma-core.spec b/rdma-core.spec
index 131cbd6a67a740033ba3e732fcd5fd0628cfcd1b..f6874535636816adc64bdb0d310d3302df64cef5 100644
--- a/rdma-core.spec
+++ b/rdma-core.spec
@@ -1,6 +1,6 @@
 Name:           rdma-core
 Version:        41.0
-Release:        35
+Release:        36
 Summary:        RDMA core userspace libraries and daemons
 License:        GPLv2 or BSD
 Url:            https://github.com/linux-rdma/rdma-core
@@ -104,6 +104,7 @@ patch95: 0095-libhns-Adapt-UD-inline-data-size-for-UCX.patch
 patch96: 0096-libhns-Fix-wrong-order-of-spin_unlock-in-modify_qp.patch
 patch97: 0097-libxscale-Match-dev-by-vid-and-did.patch
 patch98: 0098-libxscale-update-to-version-2412GA.patch
+patch99: 0099-libhns-Fix-double-free-of-rinl_buf-wqe_list.patch
 
 BuildRequires:  binutils cmake >= 2.8.11 gcc libudev-devel pkgconfig pkgconfig(libnl-3.0)
 BuildRequires:  pkgconfig(libnl-route-3.0) valgrind-devel systemd systemd-devel
@@ -354,6 +355,12 @@ fi
 %{_mandir}/*
 
 %changelog
+* Sat Jul 5 2025 hbmm <hebimeng1@h-partners.com.com> - 41.0-36
+- Type: bugfix
+- ID: NA
+- SUG: NA
+- DESC: libhns: Fix double-free of rinl_buf->wqe_list
+
 * Wed May 14 2025 Xin Tian <tianx@yunsilicon.com> - 41.0-35
 - Type: feature
 - ID: NA