diff --git a/dhcp.spec b/dhcp.spec
index 1f1c153..65a73e4 100644
--- a/dhcp.spec
+++ b/dhcp.spec
@@ -15,7 +15,7 @@
 Summary:  Dynamic host configuration protocol software
 Name:     dhcp
 Version:  4.4.2
-Release:  21.b1%{?dist}
+Release:  22.b1%{?dist}
 
 # NEVER CHANGE THE EPOCH on this package.  The previous maintainer (prior to
 # dcantrell maintaining the package) made incorrect use of the epoch and
@@ -70,6 +70,7 @@ Patch32: CVE-2022-2928.patch
 Patch33: CVE-2022-2929.patch
 Patch34: dont-drop-bounds-twice.patch
 Patch35: fix-buffer-overflow-in-print_hw_addr.patch
+Patch36: fix-sll-leak-aliased-ib-interface.patch
 
 
 BuildRequires: autoconf
@@ -513,6 +514,10 @@ done
 %endif
 
 %changelog
+* Thu Aug 06 2026 Martin Osvald <mosvald@redhat.com> - 12:4.4.2-22.b1
+- Fix sll pointer leak for aliased InfiniBand interfaces in get_hw_addr2()
+  Resolves: RHEL-235872
+
 * Tue Mar 31 2026 Martin Osvald <mosvald@redhat.com> - 12:4.4.2-21.b1
 - Fix buffer overflow in print_hw_addr()
   Resolves: RHEL-151420
diff --git a/fix-sll-leak-aliased-ib-interface.patch b/fix-sll-leak-aliased-ib-interface.patch
new file mode 100644
index 0000000..9674bb6
--- /dev/null
+++ b/fix-sll-leak-aliased-ib-interface.patch
@@ -0,0 +1,30 @@
+From: Martin Osvald <mosvald@redhat.com>
+Date: Wed, 6 Aug 2026 10:00:00 +0200
+Subject: [PATCH] Fix sll pointer leak for aliased InfiniBand interfaces
+
+When get_ll() fails for an aliased IB interface (e.g. ib0:0) and
+ioctl_get_ll() is used instead (sll_allocated=1), the ARPHRD_INFINIBAND
+case strips the alias suffix and re-calls get_ll(), overwriting sll with
+an ifaddrs-internal pointer while sll_allocated remains 1. The subsequent
+dfree(sll, MDL) then frees a pointer not returned by dmalloc, causing
+heap corruption and SIGABRT ("free(): invalid pointer").
+
+Free the ioctl_get_ll() allocation before overwriting sll.
+
+Signed-off-by: Martin Osvald <mosvald@redhat.com>
+Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
+diff --git a/common/lpf.c b/common/lpf.c
+index 25f4c68..cbbdedc 100644
+--- a/common/lpf.c
++++ b/common/lpf.c
+@@ -784,6 +784,10 @@ get_hw_addr2(struct interface_info *info)
+ 			*/
+ 			if ((colon = strchr(dup, ':')) != NULL) {
+ 				*colon = '\0';
++				if (sll_allocated) {
++					dfree(sll, MDL);
++					sll_allocated = 0;
++				}
+ 				if ((sll = get_ll(ifaddrs, &ifa, dup)) == NULL)
+ 					log_fatal("Error getting hardware address for \"%s\": %m", name);
+ 			}