diff --git a/backport-systemctl-fix-memleak.patch b/backport-systemctl-fix-memleak.patch
new file mode 100644
index 0000000000000000000000000000000000000000..aee94a61efef06c0ca24756f31ac52deef49057e
--- /dev/null
+++ b/backport-systemctl-fix-memleak.patch
@@ -0,0 +1,43 @@
+From e820e232210376b0a1f9d3a562395beab9206ed8 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 27 Jan 2025 04:17:27 +0900
+Subject: [PATCH] systemctl: fix memleak
+
+Fixes a bug introduced by adb6cd9be2b7e9e614d2b5835c7b70cf8eacc852.
+
+Fixes #36178.
+
+(cherry picked from commit 08570f284140752b9f0aad4dbcdff32c090a3661)
+(cherry picked from commit 0240c4ac435ed8db413d83474dd8524e655dfb94)
+(cherry picked from commit 6a1b9afc077c9a526fe0419f22afb4794b5a35e4)
+---
+ src/systemctl/systemctl-is-system-running.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/systemctl/systemctl-is-system-running.c b/src/systemctl/systemctl-is-system-running.c
+index 59be6a7a7e..8d5303c2d8 100644
+--- a/src/systemctl/systemctl-is-system-running.c
++++ b/src/systemctl/systemctl-is-system-running.c
+@@ -66,6 +66,10 @@ int verb_is_system_running(int argc, char *argv[], void *userdata) {
+         }
+ 
+         if (arg_wait && STR_IN_SET(state, "initializing", "starting")) {
++                /* The signal handler will allocate memory and assign to 'state', hence need to free previous
++                 * one before entering the event loop. */
++                state = mfree(state);
++
+                 r = sd_event_loop(event);
+                 if (r < 0) {
+                         log_warning_errno(r, "Failed to get property from event loop: %m");
+@@ -73,6 +77,8 @@ int verb_is_system_running(int argc, char *argv[], void *userdata) {
+                                 puts("unknown");
+                         return EXIT_FAILURE;
+                 }
++
++                assert(state);
+         }
+ 
+         if (!arg_quiet)
+-- 
+2.43.0
+
diff --git a/systemd.spec b/systemd.spec
index 3b167e60595871fb0469fc1e6172d8b8f125cc41..1f4019cb0dc2536f189524d25abcf42c00aa0d00 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -25,7 +25,7 @@
 Name:           systemd
 Url:            https://systemd.io/
 Version:        249
-Release:        105
+Release:        106
 License:        MIT and LGPLv2+ and GPLv2+
 Summary:        System and Service Manager
 
@@ -748,6 +748,8 @@ Patch6694:      backport-CVE-2025-4598-coredump-use-d-in-kernel-core-pattern.pat
 Patch6695:      backport-0001-coredump-get-rid-of-a-bogus-assertion.patch
 Patch6696:      backport-core-mount-adjust-deserialized-state-based-on-proc-s.patch
 Patch6697:      backport-core-shorten-long-unit-names-that-are-based-on-paths.patch
+#fix ISSUE[#ICVCYY]
+Patch6698:		backport-systemctl-fix-memleak.patch
 
 Patch9001:      update-rtc-with-system-clock-when-shutdown.patch
 Patch9002:      udev-add-actions-while-rename-netif-failed.patch
@@ -2264,6 +2266,9 @@ grep -q -E '^KEYMAP="?fi-latin[19]"?' /etc/vconsole.conf 2>/dev/null &&
 /usr/bin/systemd-cryptenroll
 
 %changelog
+* Wed Sep 03 2025 Linux_zhang <zhangruifang@h-partners.com> - 249-106
+- sync patch from systemd community
+
 * Tue Jul 15 2025 caiwentao <cwt678@126.com> - 249-105
 - core: shorten long unit names that are based on paths and append path hash at the end