diff --git a/patches.suse/fs-aio-Restrict-kiocb_set_cancel_fn-to-I-O-submitted.patch b/patches.suse/fs-aio-Restrict-kiocb_set_cancel_fn-to-I-O-submitted.patch
new file mode 100644
index 0000000..b55996e
--- /dev/null
+++ b/patches.suse/fs-aio-Restrict-kiocb_set_cancel_fn-to-I-O-submitted.patch
@@ -0,0 +1,85 @@
+From b820de741ae48ccf50dd95e297889c286ff4f760 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Thu, 15 Feb 2024 12:47:38 -0800
+Subject: [PATCH] fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via
+ libaio
+Git-commit: b820de741ae48ccf50dd95e297889c286ff4f760
+Patch-mainline: v6.8-rc6
+References: bsc#1222721 CVE-2024-26764
+
+If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the
+following kernel warning appears:
+
+Warning: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8
+Call trace:
+ kiocb_set_cancel_fn+0x9c/0xa8
+ ffs_epfile_read_iter+0x144/0x1d0
+ io_read+0x19c/0x498
+ io_issue_sqe+0x118/0x27c
+ io_submit_sqes+0x25c/0x5fc
+ __arm64_sys_io_uring_enter+0x104/0xab0
+ invoke_syscall+0x58/0x11c
+ el0_svc_common+0xb4/0xf4
+ do_el0_svc+0x2c/0xb0
+ el0_svc+0x2c/0xa4
+ el0t_64_sync_handler+0x68/0xb4
+ el0t_64_sync+0x1a4/0x1a8
+
+Fix this by setting the IOCB_AIO_RW flag for read and write I/O that is
+submitted by libaio.
+
+Suggested-by: Jens Axboe <axboe@kernel.dk>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Avi Kivity <avi@scylladb.com>
+Cc: Sandeep Dhavale <dhavale@google.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Kent Overstreet <kent.overstreet@linux.dev>
+Cc: stable@vger.kernel.org
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20240215204739.2677806-2-bvanassche@acm.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ fs/aio.c           |    9 ++++++++-
+ include/linux/fs.h |    3 +++
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -564,6 +564,13 @@ void kiocb_set_cancel_fn(struct kiocb *i
+ 	struct kioctx *ctx = req->ki_ctx;
+ 	unsigned long flags;
+ 
++	/*
++	 * kiocb didn't come from aio or is neither a read nor a write, hence
++	 * ignore it.
++	 */
++	if (!(iocb->ki_flags & IOCB_AIO_RW))
++		return;
++
+ 	if (WARN_ON_ONCE(!list_empty(&req->ki_list)))
+ 		return;
+ 
+@@ -1449,7 +1456,7 @@ static int aio_prep_rw(struct kiocb *req
+ 	req->ki_complete = aio_complete_rw;
+ 	req->private = NULL;
+ 	req->ki_pos = iocb->aio_offset;
+-	req->ki_flags = iocb_flags(req->ki_filp);
++	req->ki_flags = iocb_flags(req->ki_filp) | IOCB_AIO_RW;
+ 	if (iocb->aio_flags & IOCB_FLAG_RESFD)
+ 		req->ki_flags |= IOCB_EVENTFD;
+ 	req->ki_hint = ki_hint_validate(file_write_hint(req->ki_filp));
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -320,6 +320,9 @@ enum rw_hint {
+ #define IOCB_WAITQ		(1 << 19)
+ #define IOCB_NOIO		(1 << 20)
+ 
++/* kiocb is a read or write operation submitted by fs/aio.c. */
++#define IOCB_AIO_RW		(1 << 23)
++
+ struct kiocb {
+ 	struct file		*ki_filp;
+ 
diff --git a/series.conf b/series.conf
index 8303eaa..f388d53 100644
--- a/series.conf
+++ b/series.conf
@@ -23559,6 +23559,7 @@
 	patches.suse/IB-hfi1-Fix-sdma.h-tx-num_descs-off-by-one-error.patch
 	patches.suse/net-sched-act_mirred-don-t-override-retval-if-we-alr.patch
 	patches.suse/arp-Prevent-overflow-in-arp_req_get.patch
+	patches.suse/fs-aio-Restrict-kiocb_set_cancel_fn-to-I-O-submitted.patch
 	patches.suse/Bluetooth-rfcomm-Fix-null-ptr-deref-in-rfcomm_check_.patch
 	patches.suse/tomoyo-fix-UAF-write-bug-in-tomoyo_write_control.patch
 	patches.suse/btrfs-fix-double-free-of-anonymous-device-after-snap.patch