diff --git a/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch b/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch
new file mode 100644
index 0000000..1906229
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch
@@ -0,0 +1,84 @@
+From a8374915ceb752f08385de1eaf1d8782246047ae Mon Sep 17 00:00:00 2001
+From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Date: Tue, 16 Jun 2026 12:16:05 +0900
+Subject: [PATCH] awk: fix stack overflow in evaluate()
+
+Recursive awk functions can keep re-entering evaluate() until the
+process stack is exhausted. Track active function-call depth and report a
+normal awk error once the limit is reached instead of overflowing the
+stack.
+
+CVE: CVE-2026-38752
+Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2026-June/092351.html]
+
+Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ editors/awk.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/editors/awk.c b/editors/awk.c
+index dd8f4ac..f15832b 100644
+--- a/editors/awk.c
++++ b/editors/awk.c
+@@ -633,6 +633,7 @@ struct globals {
+ 	smalluint exitcode;
+ 
+ 	unsigned evaluate__seed;
++	unsigned evaluate__func_depth;
+ 	var *evaluate__fnargs;
+ 	regex_t evaluate__sreg;
+ 
+@@ -703,6 +704,7 @@ static const char EMSG_UNEXP_TOKEN[] ALIGN1 = "Unexpected token";
+ static const char EMSG_DIV_BY_ZERO[] ALIGN1 = "Division by zero";
+ static const char EMSG_INV_FMT[] ALIGN1 = "Invalid format specifier";
+ static const char EMSG_TOO_FEW_ARGS[] ALIGN1 = "Too few arguments";
++static const char EMSG_RECURSION[] ALIGN1 = "Recursion limit exceeded";
+ static const char EMSG_NOT_ARRAY[] ALIGN1 = "Not an array";
+ static const char EMSG_POSSIBLE_ERROR[] ALIGN1 = "Possible syntax error";
+ static const char EMSG_UNDEF_FUNC[] ALIGN1 = "Call to undefined function";
+@@ -2988,6 +2990,7 @@ static var *evaluate(node *op, var *res)
+ #define fnargs (G.evaluate__fnargs)
+ /* seed is initialized to 1 */
+ #define seed   (G.evaluate__seed)
++#define func_depth (G.evaluate__func_depth)
+ #define sreg   (G.evaluate__sreg)
+ 
+ 	var *tmpvars;
+@@ -3299,13 +3302,17 @@ static var *evaluate(node *op, var *res)
+ 			var *argvars, *sv_fnargs;
+ 			const char *sv_progname;
+ 			int nargs, i;
++			enum { MAX_AWK_FUNC_DEPTH = 1000 };
+ 
+ 			debug_printf_eval("FUNC\n");
+ 
+ 			if (!op->r.f->defined)
+ 				syntax_error(EMSG_UNDEF_FUNC);
++			if (func_depth >= MAX_AWK_FUNC_DEPTH)
++				syntax_error(EMSG_RECURSION);
+ 
+ 			/* The body might be empty, still has to eval the args */
++			func_depth++;
+ 			nargs = op->r.f->nargs;
+ 			argvars = nvalloc(nargs);
+ 			i = 0;
+@@ -3333,6 +3340,7 @@ static var *evaluate(node *op, var *res)
+ 
+ 			g_progname = sv_progname;
+ 			fnargs = sv_fnargs;
++			func_depth--;
+ 
+ 			break;
+ 		}
+@@ -3690,6 +3698,7 @@ static var *evaluate(node *op, var *res)
+ 	return res;
+ #undef fnargs
+ #undef seed
++#undef func_depth
+ #undef sreg
+ }
+ 
+-- 
+2.35.6
+
diff --git a/meta/recipes-core/busybox/busybox_1.38.0.bb b/meta/recipes-core/busybox/busybox_1.38.0.bb
index a75c639..bf78951 100644
--- a/meta/recipes-core/busybox/busybox_1.38.0.bb
+++ b/meta/recipes-core/busybox/busybox_1.38.0.bb
@@ -59,6 +59,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://0001-busybox-fix-printf-ptest-failure-with-glibc-2.43.patch \
            file://CVE-2025-60876.patch \
            file://CVE-2024-58251.patch \
+           file://CVE-2026-38752.patch \
            file://CVE-2026-38754.patch \
            "
 SRC_URI:append:libc-musl = " file://musl.cfg"