diff --git a/dnsmasq-2.93-CVE-2026-4893.patch b/dnsmasq-2.93-CVE-2026-4893.patch
new file mode 100644
index 0000000..773c6df
--- /dev/null
+++ b/dnsmasq-2.93-CVE-2026-4893.patch
@@ -0,0 +1,33 @@
+From 4b8388d967e207b277c45e1fc0fb646767e5ca5d Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Wed, 25 Mar 2026 23:22:37 +0000
+Subject: [PATCH] Fix broken client subnet validation. CVE-2026-4893
+
+Bug report from Royce M <royce@xchglabs.com>
+
+Location: forward.c:713, edns0.c:421
+
+With --add-subnet enabled, process_reply() passes the OPT record
+length (~23 bytes) instead of the packet length to check_source().
+All internal bounds checks fail, and the function always returns 1.
+ECS source validation per RFC 7871 Section 9.2 is completely bypassed.
+---
+ src/forward.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/forward.c b/src/forward.c
+index d27f230..156770a 100644
+--- a/src/forward.c
++++ b/src/forward.c
+@@ -629,7 +629,7 @@ static size_t process_reply(struct dns_header *header, time_t now, struct server
+   
+   if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign, NULL)))
+     {
+-      if (check_subnet && !check_source(header, plen, pheader, query_source))
++      if (check_subnet && !check_source(header, n, pheader, query_source))
+ 	{
+ 	  my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
+ 	  return 0;
+-- 
+2.54.0
+
diff --git a/dnsmasq.spec b/dnsmasq.spec
index ca13578..77f5c6b 100644
--- a/dnsmasq.spec
+++ b/dnsmasq.spec
@@ -111,6 +111,7 @@ Patch49:        dnsmasq-2.93-CVE-2026-2291.patch
 Patch50:        dnsmasq-2.93-CVE-2026-4890.patch
 Patch51:        dnsmasq-2.93-CVE-2026-4891.patch
 Patch52:        dnsmasq-2.93-CVE-2026-4892.patch
+Patch53:        dnsmasq-2.93-CVE-2026-4893.patch
 
 # This is workaround to nettle bug #1549190
 # https://bugzilla.redhat.com/show_bug.cgi?id=1549190
@@ -196,6 +197,7 @@ server's leases.
 %patch50 -p1 -b .CVE-2026-4890
 %patch51 -p1 -b .CVE-2026-4891
 %patch52 -p1 -b .CVE-2026-4892
+%patch53 -p1 -b .CVE-2026-4893
 
 # use /var/lib/dnsmasq instead of /var/lib/misc
 for file in dnsmasq.conf.example man/dnsmasq.8 man/es/dnsmasq.8 src/config.h; do
@@ -300,6 +302,7 @@ install -Dpm 644 %{SOURCE2} %{buildroot}%{_sysusersdir}/dnsmasq.conf
 - Prevent DoS in DNSSEC validation (CVE-2026-4890)
 - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891)
 - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892)
+- Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893)
 
 * Mon Aug 18 2025 Tomas Korbar <tkorbar@redhat.com> - 2.79-35
 - Fix dnsmasq caching of intertwined CNAMES