diff --git a/meta/recipes-devtools/patch/patch.inc b/meta/recipes-devtools/patch/patch.inc
index 4b90ece07c6..108ad63996a 100644
--- a/meta/recipes-devtools/patch/patch.inc
+++ b/meta/recipes-devtools/patch/patch.inc
@@ -5,9 +5,7 @@ original files, producing patched versions."
 SECTION = "utils"
 HOMEPAGE = "http://savannah.gnu.org/projects/patch/"
 
-SRC_URI = "${GNU_MIRROR}/patch/patch-${PV}.tar.gz \
- 	   file://CVE-2026-56289.patch \
- 	   file://CVE-2026-56288.patch \
+SRC_URI = "${GNU_MIRROR}/patch/patch-${PV}.tar.xz \
  	   file://run-ptest \
    	   "
 
diff --git a/meta/recipes-devtools/patch/patch/CVE-2026-56288.patch b/meta/recipes-devtools/patch/patch/CVE-2026-56288.patch
deleted file mode 100644
index 7219f5a3c7d..00000000000
--- a/meta/recipes-devtools/patch/patch/CVE-2026-56288.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 101a805510356092a6d2a864bb18d440fec57f0a Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Tue, 21 Apr 2026 10:05:02 -0700
-Subject: [PATCH] Avoid null pointer derefence with bad hunks
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Problem reported by Michał Majchrowicz.
-* src/pch.c (another_hunk): Keep chars_read positive
-even with malformed hunks.
-
-CVE: CVE-2026-56288
-Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313]
-
-(cherry picked from commit e6d6a4e021660679d7fc9150f981d4920f722313)
-Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
----
- src/pch.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/src/pch.c b/src/pch.c
-index d9f5c61..41150fe 100644
---- a/src/pch.c
-+++ b/src/pch.c
-@@ -1694,7 +1694,8 @@ another_hunk (enum diff difftype, bool rev)
- 		    p_end = filldst-1;
- 		    malformed ();
- 		}
--		chars_read -= fillsrc == p_ptrn_lines && incomplete_line ();
-+		chars_read -= (1 < chars_read && fillsrc == p_ptrn_lines
-+			       && incomplete_line ());
- 		p_Char[fillsrc] = ch;
- 		p_line[fillsrc] = s;
- 		p_len[fillsrc++] = chars_read;
-@@ -1711,7 +1712,8 @@ another_hunk (enum diff difftype, bool rev)
- 		    malformed ();
- 		}
- 		context++;
--		chars_read -= fillsrc == p_ptrn_lines && incomplete_line ();
-+		chars_read -= (1 < chars_read && fillsrc == p_ptrn_lines
-+			       && incomplete_line ());
- 		p_Char[fillsrc] = ch;
- 		p_line[fillsrc] = s;
- 		p_len[fillsrc++] = chars_read;
-@@ -1725,7 +1727,8 @@ another_hunk (enum diff difftype, bool rev)
- 		    p_end = fillsrc-1;
- 		    malformed ();
- 		}
--		chars_read -= filldst == p_end && incomplete_line ();
-+		chars_read -= (1 < chars_read && filldst == p_end
-+			       && incomplete_line ());
- 		p_Char[filldst] = ch;
- 		p_line[filldst] = s;
- 		p_len[filldst++] = chars_read;
-@@ -1808,7 +1811,8 @@ another_hunk (enum diff difftype, bool rev)
- 	      fatal (("'<' followed by space or tab expected"
- 		      " at line %td of patch"),
- 		     p_input_line);
--	    chars_read -= 2 + (i == p_ptrn_lines && incomplete_line ());
-+	    chars_read -= 2 + (3 < chars_read && i == p_ptrn_lines
-+			       && incomplete_line ());
- 	    p_len[i] = chars_read;
- 	    p_line[i] = savebuf (patchbuf + 2, chars_read);
- 	    p_Char[i] = '-';
-@@ -1833,7 +1837,8 @@ another_hunk (enum diff difftype, bool rev)
- 	      fatal (("'>' followed by space or tab expected"
- 		      " at line %td of patch"),
- 		     p_input_line);
--	    chars_read -= 2 + (i == p_end && incomplete_line ());
-+	    chars_read -= 2 + (3 < chars_read && i == p_end
-+			       && incomplete_line ());
- 	    p_len[i] = chars_read;
- 	    p_line[i] = savebuf (patchbuf + 2, chars_read);
- 	    p_Char[i] = '+';
diff --git a/meta/recipes-devtools/patch/patch/CVE-2026-56289.patch b/meta/recipes-devtools/patch/patch/CVE-2026-56289.patch
deleted file mode 100644
index 8f98c444fc6..00000000000
--- a/meta/recipes-devtools/patch/patch/CVE-2026-56289.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From e89f7be0853836908226e1df746fe07ef7c46769 Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Tue, 21 Apr 2026 13:16:10 -0700
-Subject: [PATCH] =?UTF-8?q?Don=E2=80=99t=20infloop=20on=20null=20ranges?=
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Problem reported by Michał Majchrowicz.
-* src/patch.c (locate_hunk): Don’t attempt to optimize
-matches of a null range.  Instead, apply all the checks
-we apply to non-null ranges.
-
-CVE: CVE-2026-56289
-Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9]
-
-(cherry picked from commit faba04ef4f2b410257f76c1b9dc85e350929c4b9)
-Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
----
- src/patch.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/src/patch.c b/src/patch.c
-index e4d0524..1e7dfdc 100644
---- a/src/patch.c
-+++ b/src/patch.c
-@@ -1166,9 +1166,6 @@ locate_hunk (idx_t fuzz)
-     ptrdiff_t max_offset = MAX (max_pos_offset, max_neg_offset);
-     ptrdiff_t min_offset;
- 
--    if (!pat_lines)			/* null range matches always */
--	return first_guess;
--
-     /* Do not try lines <= 0.  */
-     if (first_guess <= max_neg_offset)
- 	max_neg_offset = first_guess - 1;
diff --git a/meta/recipes-devtools/patch/patch_2.8.bb b/meta/recipes-devtools/patch/patch_2.8.1.bb
similarity index 80%
rename from meta/recipes-devtools/patch/patch_2.8.bb
rename to meta/recipes-devtools/patch/patch_2.8.1.bb
index 33142ac5746..16188008f0b 100644
--- a/meta/recipes-devtools/patch/patch_2.8.bb
+++ b/meta/recipes-devtools/patch/patch_2.8.1.bb
@@ -3,7 +3,7 @@ LICENSE = "GPL-3.0-only"
 
 CVE_PRODUCT = "gnu:patch"
 
-SRC_URI[sha256sum] = "308a4983ff324521b9b21310bfc2398ca861798f02307c79eb99bb0e0d2bf980"
+SRC_URI[sha256sum] = "3240c7959c5347c8ed347e3c4201c0337bf4240d5cf09d68889e58eeaba30e17"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"