diff --git a/bcc-0.25.0-clang-check-header-ownership-4928.patch b/bcc-0.25.0-clang-check-header-ownership-4928.patch
new file mode 100644
index 0000000..a25fd26
--- /dev/null
+++ b/bcc-0.25.0-clang-check-header-ownership-4928.patch
@@ -0,0 +1,68 @@
+From d6a5130c5f18499da26eef88f52da75c9e33d63d Mon Sep 17 00:00:00 2001
+From: Brendan Gregg <brendan@intel.com>
+Date: Thu, 7 Mar 2024 05:27:14 +1100
+Subject: [PATCH] clang: check header ownership (#4928)
+
+Example testing with a brendan-owned /tmp/kheaders file (note the "ERROR:" message):
+
+~/bcc/build$ sudo /usr/share/bcc/tools/biosnoop
+ERROR: header file ownership unexpected: /tmp/kheaders-5.15.47-internal
+<built-in>:1:10: fatal error: './include/linux/kconfig.h' file not found
+#include "./include/linux/kconfig.h"
+         ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+1 error generated.
+Traceback (most recent call last):
+  File "/usr/share/bcc/tools/biosnoop", line 335, in <module>
+    b = BPF(text=bpf_text)
+  File "/usr/lib/python3/dist-packages/bcc-0.1.5+6cd27218-py3.10.egg/bcc/__init__.py", line 479, in __init__
+Exception: Failed to compile BPF module <text>
+~/bcc/build$ ls -lhd /tmp/kheaders-5.15.47-internal
+drwxrwxr-x 2 brendan dev 4.0K Mar  6 02:50 /tmp/kheaders-5.15.47-internal
+
+No error when chown'd back to root.
+---
+ src/cc/frontends/clang/kbuild_helper.cc | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
+index 933aec8e..1b291469 100644
+--- a/src/cc/frontends/clang/kbuild_helper.cc
++++ b/src/cc/frontends/clang/kbuild_helper.cc
+@@ -140,15 +140,22 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
+   return 0;
+ }
+ 
+-static inline int file_exists(const char *f)
++static inline int file_exists_and_ownedby(const char *f, uid_t uid)
+ {
+   struct stat buffer;
+-  return (stat(f, &buffer) == 0);
++  int ret;
++  if ((ret = stat(f, &buffer)) == 0) {
++    if (buffer.st_uid != uid) {
++      std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n";
++      return -1;
++    }
++  }
++  return ret;
+ }
+ 
+ static inline int proc_kheaders_exists(void)
+ {
+-  return file_exists(PROC_KHEADERS_PATH);
++  return file_exists_and_ownedby(PROC_KHEADERS_PATH, 0);
+ }
+ 
+ static inline int extract_kheaders(const std::string &dirpath,
+@@ -214,7 +221,7 @@ int get_proc_kheaders(std::string &dirpath)
+   snprintf(dirpath_tmp, 256, "/tmp/kheaders-%s", uname_data.release);
+   dirpath = std::string(dirpath_tmp);
+ 
+-  if (file_exists(dirpath_tmp))
++  if (file_exists_and_ownedby(dirpath_tmp, 0))
+     return 0;
+ 
+   // First time so extract it
+-- 
+2.43.2
+
diff --git a/bcc.spec b/bcc.spec
index 71768c8..93704ea 100644
--- a/bcc.spec
+++ b/bcc.spec
@@ -9,7 +9,7 @@
 
 Name:           bcc
 Version:        0.25.0
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        BPF Compiler Collection (BCC)
 License:        ASL 2.0
 URL:            https://github.com/iovisor/bcc
@@ -29,7 +29,7 @@ Patch11:        %{name}-%{version}-Fix-a-llvm-compilation-error.patch
 Patch12:        %{name}-%{version}-Fix-compilation-error-when-built-with-llvm17.patch
 Patch13:        %{name}-%{version}-tools-tcpstates-fix-context-ptr-modified-error.patch
 Patch14:        %{name}-%{version}-tools-tcpstates-fix-IPv6-journal.patch
-
+Patch15:        %{name}-%{version}-clang-check-header-ownership-4928.patch
 
 # Arches will be included as upstream support is added and dependencies are
 # satisfied in the respective arches
@@ -227,6 +227,9 @@ done
 
 
 %changelog
+* Tue Mar 12 2024 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-8
+- Check header ownership (RHEL-28768)
+
 * Wed Nov 08 2023 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-7
 - Fix repo URL in tests.yml