diff --git a/SOURCES/0016-Don-t-allow-suid-and-dev-set-on-fs-resize.patch b/SOURCES/0016-Don-t-allow-suid-and-dev-set-on-fs-resize.patch
new file mode 100644
index 0000000..36f3b4a
--- /dev/null
+++ b/SOURCES/0016-Don-t-allow-suid-and-dev-set-on-fs-resize.patch
@@ -0,0 +1,26 @@
+From 2118ed49dcf6adf60c6c544667dbf71c54239b86 Mon Sep 17 00:00:00 2001
+From: Thomas Blume <Thomas.Blume@suse.com>
+Date: Fri, 16 May 2025 14:27:10 +0200
+Subject: [PATCH] Don't allow suid and dev set on fs resize
+
+Fixes: CVE-2025-6019
+---
+ src/plugins/fs/generic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/plugins/fs/generic.c b/src/plugins/fs/generic.c
+index ca08d19a..15b55271 100644
+--- a/src/plugins/fs/generic.c
++++ b/src/plugins/fs/generic.c
+@@ -409,7 +409,7 @@ static gboolean xfs_resize_device (const gchar *device, guint64 new_size, const
+                              "before resizing it.", device);
+                 return FALSE;
+             }
+-            ret = bd_fs_mount (device, mountpoint, "xfs", NULL, NULL, error);
++            ret = bd_fs_mount (device, mountpoint, "xfs", "nosuid,nodev", NULL, error);
+             if (!ret) {
+                 g_prefix_error (error, "Failed to mount '%s' before resizing it: ", device);
+                 return FALSE;
+-- 
+2.49.0
+
diff --git a/SPECS/libblockdev.spec b/SPECS/libblockdev.spec
index 86605ee..4fc34b8 100644
--- a/SPECS/libblockdev.spec
+++ b/SPECS/libblockdev.spec
@@ -129,7 +129,7 @@
 
 Name:        libblockdev
 Version:     2.28
-Release:     13%{?dist}
+Release:     14%{?dist}
 Summary:     A library for low-level manipulation with block devices
 License:     LGPLv2+
 URL:         https://github.com/storaged-project/libblockdev
@@ -150,6 +150,7 @@ Patch12:     0012-lvm-Add-support-for-starting-and-stopping-VG-locking.patch
 Patch13:     0013-tests-Remove_unreliable_nvme_attribute_checks.patch
 Patch14:     0014-nvme-Add-bd_nvme_is_tech_avail-to-the-API-file.patch
 Patch15:     0015-crypto-Add-a-function-to-set-persistent-flags-for-LU.patch
+Patch16:     0016-Don-t-allow-suid-and-dev-set-on-fs-resize.patch
 
 BuildRequires: make
 BuildRequires: glib2-devel
@@ -1048,6 +1049,10 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm}
 %files plugins-all
 
 %changelog
+* Mon Jun 23 2025 Vojtech Trefny <vtrefny@redhat.com> - 2.28-14
+- Don't allow suid and dev set on fs resize
+  Resolves: RHEL-96039
+
 * Tue Mar 11 2025 Vojtech Trefny <vtrefny@redhat.com> - 2.28-13
 - crypto: Add a function to set persistent flags for LUKS
   Resolves: RHEL-82886