diff --git a/gawk-4.2.1-CVE-2026-40467.patch b/gawk-4.2.1-CVE-2026-40467.patch
new file mode 100644
index 0000000..65db883
--- /dev/null
+++ b/gawk-4.2.1-CVE-2026-40467.patch
@@ -0,0 +1,40 @@
+From 06ab08ad83f62b61cc8277bb16d3e51c7f0ee123 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Fri, 3 Apr 2026 12:02:11 +0300
+Subject: [PATCH] Small memory management fix in io.c.
+
+---
+ io.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/io.c b/io.c
+index 33eacf8..c03aaf6 100644
+--- a/io.c
++++ b/io.c
+@@ -2790,22 +2790,25 @@ do_getline_redir(int into_variable, enum redirval redirtype)
+ 	assert(redirtype != redirect_none);
+ 	redir_exp = TOP();
+ 	rp = redirect(redir_exp, redirtype, & redir_error, false);
+-	DEREF(redir_exp);
+ 	decr_sp();
+ 	if (rp == NULL) {
+ 		if (redir_error) { /* failed redirect */
+ 			if (! do_traditional)
+ 				update_ERRNO_int(redir_error);
+ 		}
++		DEREF(redir_exp);
+ 		return make_number((AWKNUM) -1.0);
+ 	} else if ((rp->flag & RED_TWOWAY) != 0 && rp->iop == NULL) {
+ 		if (is_non_fatal_redirect(redir_exp->stptr, redir_exp->stlen)) {
+ 			update_ERRNO_int(EBADF);
++			DEREF(redir_exp);
+ 			return make_number((AWKNUM) -1.0);
+ 		}
+ 		(void) close_rp(rp, CLOSE_ALL);
++		DEREF(redir_exp);	// we're about to die, but what the heck, release it anyway
+ 		fatal(_("getline: attempt to read from closed read end of two-way pipe"));
+ 	}
++	DEREF(redir_exp);
+ 	iop = rp->iop;
+ 	if (iop == NULL)		/* end of input */
+ 		return make_number((AWKNUM) 0.0);
diff --git a/gawk.spec b/gawk.spec
index 8baee0b..5440d76 100644
--- a/gawk.spec
+++ b/gawk.spec
@@ -44,7 +44,7 @@
 Name:             gawk
 Summary:          The GNU version of the AWK text processing utility
 Version:          4.2.1
-Release:          4%{?dist}.1
+Release:          5%{?dist}
 
 License:          GPLv3+ and GPLv2+ and LGPLv2+ and BSD
 
@@ -111,6 +111,10 @@ Patch001: proc-rv.patch
 # https://github.com/sysfce2/gawk/commit/aa7272a6e1184cdd21ab8f89200219abd8053eda
 Patch002: gawk-4.2.1-CVE-2026-40468.patch
 
+# https://issues.redhat.com/browse/RHEL-222601
+# https://cgit.git.savannah.gnu.org/cgit/gawk.git/patch/?id=a2d18c74109e41bec29a23098eba2e00057286d8
+Patch003: gawk-4.2.1-CVE-2026-40467.patch
+
 # Downstream patches -- these should be always included when doing rebase:
 # ------------------
 #Patch100: example100.patch
@@ -261,6 +265,10 @@ install -m 0644 -p doc/gawkinet.{pdf,ps} %{buildroot}%{_docdir}/%{name}
 # =============================================================================
 
 %changelog
+* Fri Sep 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 4.2.1-5
+- Fix use-after-free in do_getline_redir() (CVE-2026-40467)
+Resolves: RHEL-222601
+
 * Mon Aug 03 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 4.2.1-4.1
 - Fix integer overflow in do_sub() and parse_escape() (CVE-2026-40468)
 Resolves: RHEL-222771