diff --git a/0003-libblkid-use-snprintf-instead-of-sprintf.patch b/0003-libblkid-use-snprintf-instead-of-sprintf.patch
new file mode 100644
index 0000000..ee4eb7d
--- /dev/null
+++ b/0003-libblkid-use-snprintf-instead-of-sprintf.patch
@@ -0,0 +1,58 @@
+From 3e44cf04e74c1f3fed36ecc76842be414328daa7 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Mon, 6 Oct 2025 15:04:24 +0200
+Subject: libblkid: use snprintf() instead of sprintf()
+
+Replace sprintf() calls with snprintf() to ensure proper bounds
+checking when formatting strings.
+
+In encode.c, the check now validates snprintf() return value instead
+of pre-checking buffer size, providing more robust error handling.
+
+In probe.c, snprintf() is used with proper size calculation based on
+remaining buffer space.
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit 041380f4ca7244df624bf7efdb5e27fdd3144175)
+(cherry picked from commit 917917253e60b0ba485cf6a27a2f993aa43e1eea)
+---
+ libblkid/src/encode.c | 6 ++++--
+ libblkid/src/probe.c  | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/libblkid/src/encode.c b/libblkid/src/encode.c
+index 8213873ee..4b83f6690 100644
+--- a/libblkid/src/encode.c
++++ b/libblkid/src/encode.c
+@@ -191,9 +191,11 @@ int blkid_encode_string(const char *str, char *str_enc, size_t len)
+ 			j += seqlen;
+ 			i += (seqlen-1);
+ 		} else if (str[i] == '\\' || !is_whitelisted(str[i], NULL)) {
+-			if (len-j < 4)
++			int rc;
++
++			rc = snprintf(&str_enc[j], len-j, "\\x%02x", (unsigned char) str[i]);
++			if (rc != 4)
+ 				goto err;
+-			sprintf(&str_enc[j], "\\x%02x", (unsigned char) str[i]);
+ 			j += 4;
+ 		} else {
+ 			if (len-j < 1)
+diff --git a/libblkid/src/probe.c b/libblkid/src/probe.c
+index 7c561cf44..1f1031fda 100644
+--- a/libblkid/src/probe.c
++++ b/libblkid/src/probe.c
+@@ -1978,8 +1978,8 @@ static void blkid_probe_log_csum_mismatch(blkid_probe pr, size_t n, const void *
+ 	int hex_size = min(sizeof(csum_hex), n * 2);
+ 
+ 	for (int i = 0; i < hex_size; i+=2) {
+-		sprintf(&csum_hex[i], "%02X", ((const unsigned char *) csum)[i / 2]);
+-		sprintf(&expected_hex[i], "%02X", ((const unsigned char *) expected)[i / 2]);
++		snprintf(&csum_hex[i], sizeof(csum_hex) - i, "%02X", ((const unsigned char *) csum)[i / 2]);
++		snprintf(&expected_hex[i], sizeof(expected_hex) - i, "%02X", ((const unsigned char *) expected)[i / 2]);
+ 	}
+ 
+ 	ul_debug(
+-- 
+2.51.1
+
diff --git a/0004-login-utils-fix-setpwnam-buffer-use-CVE-2025-14104.patch b/0004-login-utils-fix-setpwnam-buffer-use-CVE-2025-14104.patch
new file mode 100644
index 0000000..671a079
--- /dev/null
+++ b/0004-login-utils-fix-setpwnam-buffer-use-CVE-2025-14104.patch
@@ -0,0 +1,50 @@
+From 1747ac6607bf87733423f27388819a889f658bc5 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Mon, 8 Dec 2025 13:36:41 +0100
+Subject: login-utils: fix setpwnam() buffer use [CVE-2025-14104]
+
+This issue has been originally fixed in the master branch, but
+unfortunately was not backported to stable/v2.41 yet.
+
+References: aaa9e718c88d6916b003da7ebcfe38a3c88df8e6
+References: 9a36d77012c4c771f8d51eba46b6e62c29bf572a
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit 9753e6ad9705104c3b05713f79ad6732cc4c7b30)
+---
+ login-utils/setpwnam.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/login-utils/setpwnam.c b/login-utils/setpwnam.c
+index 3e3c1abde..7778e98f7 100644
+--- a/login-utils/setpwnam.c
++++ b/login-utils/setpwnam.c
+@@ -99,7 +99,8 @@ int setpwnam(struct passwd *pwd, const char *prefix)
+ 		goto fail;
+ 
+ 	namelen = strlen(pwd->pw_name);
+-
++	if (namelen > buflen)
++		buflen += namelen;
+ 	linebuf = malloc(buflen);
+ 	if (!linebuf)
+ 		goto fail;
+@@ -126,10 +127,12 @@ int setpwnam(struct passwd *pwd, const char *prefix)
+ 		}
+ 
+ 		/* Is this the username we were sent to change? */
+-		if (!found && linebuf[namelen] == ':' &&
+-		    !strncmp(linebuf, pwd->pw_name, namelen)) {
+-			/* Yes! So go forth in the name of the Lord and
+-			 * change it!  */
++		if (!found &&
++		    strncmp(linebuf, pwd->pw_name, namelen) == 0 &&
++		    strlen(linebuf) > namelen &&
++		    linebuf[namelen] == ':') {
++			/* Yes! But this time let’s not walk past the end of the buffer
++			 * in the name of the Lord, SUID, or anything else. */
+ 			if (putpwent(pwd, fp) < 0)
+ 				goto fail;
+ 			found = 1;
+-- 
+2.51.1
+
diff --git a/util-linux.spec b/util-linux.spec
index f5198a1..70f2665 100644
--- a/util-linux.spec
+++ b/util-linux.spec
@@ -114,6 +114,10 @@ Patch1: login-default-motd-file.patch
 # Backport better support for erofs on ppc64le
 Patch2: 0001-blkid-allow-up-to-64k-erofs-block-sizes.patch
 
+Patch3: 0003-libblkid-use-snprintf-instead-of-sprintf.patch
+Patch4: 0004-login-utils-fix-setpwnam-buffer-use-CVE-2025-14104.patch
+
+
 %description
 The util-linux package contains a large variety of low-level system
 utilities that are necessary for a Linux system to function. Among