diff --git a/3025.patch b/3025.patch
new file mode 100644
index 0000000..5f2f29f
--- /dev/null
+++ b/3025.patch
@@ -0,0 +1,78 @@
+From 7b5b7ed2715e367d50fff2e23b4d6172cc7e506b Mon Sep 17 00:00:00 2001
+From: Adrian Reber <areber@redhat.com>
+Date: Thu, 21 May 2026 12:35:13 +0000
+Subject: [PATCH 1/2] service: restrict socket permissions to 0600
+
+Change the service socket permissions from 0666 (world-accessible)
+to 0600 (owner-only) to prevent unauthorized local users from
+connecting to the CRIU service socket.
+
+Print a message informing the administrator that the socket is
+restricted and that chmod should be used to widen access if needed.
+
+Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default
+
+Generated with Claude Code (https://claude.ai/code)
+
+Signed-off-by: Adrian Reber <areber@redhat.com>
+---
+ criu/cr-service.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/criu/cr-service.c b/criu/cr-service.c
+index b3ba7f03f0..d4c206d569 100644
+--- a/criu/cr-service.c
++++ b/criu/cr-service.c
+@@ -1534,12 +1534,16 @@ int cr_service(bool daemon_mode)
+ 
+ 		pr_info("The service socket is bound to %s\n", server_addr.sun_path);
+ 
+-		/* change service socket permissions, so anyone can connect to it */
+-		if (chmod(server_addr.sun_path, 0666)) {
++		/* restrict service socket permissions to owner only */
++		if (chmod(server_addr.sun_path, 0600)) {
+ 			pr_perror("Can't change permissions of the service socket");
+ 			goto err;
+ 		}
+ 
++		pr_msg("Service socket %s has permissions 0600. "
++		       "Use chmod to make it accessible to other users if needed.\n",
++		       server_addr.sun_path);
++
+ 		if (listen(server_fd, 16) == -1) {
+ 			pr_perror("Can't listen for socket connections");
+ 			goto err;
+
+From 0ffb3bc268161b08d531973e5d8be0f37eab6e99 Mon Sep 17 00:00:00 2001
+From: Adrian Reber <areber@redhat.com>
+Date: Thu, 21 May 2026 12:35:22 +0000
+Subject: [PATCH 2/2] test: adapt RPC test for restricted socket permissions
+
+The service socket now defaults to 0600 (owner-only). Since the
+test runs the setuid criu binary as a non-root user (uid 1000),
+the socket ends up owned by root. Chown the socket to the test
+user after service startup so it can connect, mirroring what an
+administrator would do in production.
+
+Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default
+
+Generated with Claude Code (https://claude.ai/code)
+
+Signed-off-by: Adrian Reber <areber@redhat.com>
+---
+ test/others/rpc/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/test/others/rpc/Makefile b/test/others/rpc/Makefile
+index 1607779c4f..17fabb6955 100644
+--- a/test/others/rpc/Makefile
++++ b/test/others/rpc/Makefile
+@@ -32,6 +32,8 @@ run: all
+ 		-d --pidfile pidfile -o service.log --status-fd 200; \
+ 		$(PYTHON) read.py build/status"
+ 	rm -f build/status
++	@# Socket defaults to 0600; transfer ownership to the test user.
++	chown 1000:1000 build/criu_service.socket
+ 	chmod a+rw build/pidfile
+ 	sudo -g '#1000' -u '#1000' ./run.sh
+ 	sudo -g '#1000' -u '#1000' ./version.py
diff --git a/criu.spec b/criu.spec
index 8ed31e1..3cdea73 100644
--- a/criu.spec
+++ b/criu.spec
@@ -13,7 +13,7 @@
 
 Name: criu
 Version: 4.2
-Release: 5%{?dist}
+Release: 6%{?dist}
 Summary: Tool for Checkpoint/Restore in User-space
 License: GPL-2.0-only AND LGPL-2.1-only AND MIT
 URL: http://criu.org/
@@ -31,6 +31,8 @@ Patch1: 0001-build-keep-LDFLAGS-intact-filter-Wl-only-for-direct-ld.patch
 
 # RHEL-189247
 Patch2: https://patch-diff.githubusercontent.com/raw/checkpoint-restore/criu/pull/3071.patch
+# RHEL-189245 RHEL-189246 RHEL-189248
+Patch3: https://patch-diff.githubusercontent.com/raw/checkpoint-restore/criu/pull/3025.patch
 
 # Add protobuf-c as a dependency.
 # We use this patch because the protobuf-c package name
@@ -115,6 +117,7 @@ This script can help to workaround the so called "PID mismatch" problem.
 %patch -P 0 -p1
 %patch -P 1 -p1
 %patch -P 2 -p1
+%patch -P 3 -p1
 %patch -P 99 -p1
 
 %build
@@ -190,6 +193,12 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a
 %doc %{_mandir}/man1/criu-ns.1*
 
 %changelog
+* Thu Jul 02 2026 Adrian Reber <areber@redhat.com> - 4.2-6
+- Apply patch to fix RHEL-189245 RHEL-189246 RHEL-189248
+- Resolves: RHEL-189245
+- Resolves: RHEL-189246
+- Resolves: RHEL-189248
+
 * Wed Jul 01 2026 Adrian Reber <areber@redhat.com> - 4.2-5
 - Apply patch to fix RHEL-189247
 - Resolves: RHEL-189247