diff --git a/SPECS/systemd/CVE-2026-15059.patch b/SPECS/systemd/CVE-2026-15059.patch
new file mode 100644
index 00000000000..fabf3e1b2b4
--- /dev/null
+++ b/SPECS/systemd/CVE-2026-15059.patch
@@ -0,0 +1,37 @@
+From cbac93f655729791942f6923fddc131bf468da2c Mon Sep 17 00:00:00 2001
+From: Luca Boccassi <luca.boccassi@gmail.com>
+Date: Wed, 3 Jun 2026 16:47:54 +0100
+Subject: [PATCH] oomd: reject invalid arguments early
+
+Validate input parameter immediately during initial parsing
+
+Follow-up for 9de5e32136949a531e71cb31170025c2e1d3430e
+
+(cherry picked from commit cde88c4ea364e816619f385a870d074ebc12fe0f)
+(cherry picked from commit 1b2a891e311acced16e0b7b16f220a2a7b08dde4)
+(cherry picked from commit 967850cb99e3644a08f195507b8de22dd63abdf5)
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/systemd/systemd/commit/a8feb2f23565d39df5c90a753c851c1934a53117.patch
+---
+ src/oom/oomd-manager.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/oom/oomd-manager.c b/src/oom/oomd-manager.c
+index 6081254..d7ae130 100644
+--- a/src/oom/oomd-manager.c
++++ b/src/oom/oomd-manager.c
+@@ -80,6 +80,11 @@ static int process_managed_oom_message(Manager *m, uid_t uid, JsonVariant *param
+                 if (r < 0)
+                         continue;
+ 
++                if (!path_is_normalized(empty_to_root(message.path))) {
++                        log_debug("Received non-normalized cgroup path '%s', ignoring.", message.path);
++                        continue;
++                }
++
+                 if (uid != 0) {
+                         uid_t cg_uid;
+ 
+-- 
+2.45.4
+
diff --git a/SPECS/systemd/systemd.spec b/SPECS/systemd/systemd.spec
index eb981d0bbe7..08b4b0889b7 100644
--- a/SPECS/systemd/systemd.spec
+++ b/SPECS/systemd/systemd.spec
@@ -50,7 +50,7 @@ Version:        255
 # determine the build information from local checkout
 Version:        %(tools/meson-vcs-tag.sh . error | sed -r 's/-([0-9])/.^\1/; s/-g/_g/')
 %endif
-Release:        33%{?dist}
+Release:        34%{?dist}
 
 # FIXME - hardcode to 'stable' for now as that's what we have in our blobstore
 %global stable 1
@@ -159,6 +159,7 @@ Patch0911:      CVE-2026-40225.patch
 Patch0912:      networkd-address-skip-firewall-init.patch
 Patch0913:      network-also-check-ID_NET_MANAGED_BY-property-on-rec.patch
 Patch0914:      Prevent-corruption-from-stale-alias-state-on-daemon-reload.patch
+Patch915:      CVE-2026-15059.patch
 
 %ifarch %{ix86} x86_64 aarch64
 %global want_bootloader 1
@@ -1257,6 +1258,9 @@ rm -f %{name}.lang
 # %autochangelog. So we need to continue manually maintaining the
 # changelog here.
 %changelog
+* Thu Aug 13 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 255-34
+- Patch for CVE-2026-15059
+
 * Mon Jun 29 2026 Kshitiz Godara <kgodara@microsoft.com> - 255-33
 - Skip tests in %%check that require capabilities not available in the build
   chroot (mount-namespace privileges, systemd-detect-virt on PATH, etc.):