diff --git a/recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch b/recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch
new file mode 100644
index 0000000..1356381
--- /dev/null
+++ b/recipes-security/selinux/selinux-sandbox/CVE-2026-59676.patch
@@ -0,0 +1,33 @@
+From 38f0a4d9a683f2cd2472d4502842df5d5b8255a8 Mon Sep 17 00:00:00 2001
+From: Stephen Smalley <stephen.smalley.work@gmail.com>
+Date: Tue, 12 May 2026 14:34:02 -0400
+Subject: [PATCH] sandbox/seunshare: pass O_NOFOLLOW to openat()
+
+We do not want to follow symlinks here.
+
+CVE: CVE-2026-59676
+Upstream-Status: Backport [https://github.com/SELinuxProject/selinux/commit/38f0a4d9a683f2cd2472d4502842df5d5b8255a8]
+
+Acked-by: James Carter <jwcart2@gmail.com>
+Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+(cherry picked from commit 38f0a4d9a683f2cd2472d4502842df5d5b8255a8)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ sandbox/seunshare.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c
+index e89a9fec..a1900eaa 100644
+--- a/sandbox/seunshare.c
++++ b/sandbox/seunshare.c
+@@ -428,7 +428,7 @@ static bool rm_rf(int targetfd, const char *path) {
+ 	}
+ 
+ 	if (S_ISDIR(statbuf.st_mode)) {
+-		const int newfd = openat(targetfd, path, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
++		const int newfd = openat(targetfd, path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+ 		if (newfd < 0) {
+ 			perror("openat");
+ 			return false;
+-- 
+2.35.6
diff --git a/recipes-security/selinux/selinux-sandbox_3.10.bb b/recipes-security/selinux/selinux-sandbox_3.10.bb
index d29cd88..f8ffd36 100644
--- a/recipes-security/selinux/selinux-sandbox_3.10.bb
+++ b/recipes-security/selinux/selinux-sandbox_3.10.bb
@@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=393a5ca445f6965873eca0259a17f833"
 require selinux_common.inc
 
 SRC_URI += "file://sandbox-de-bashify.patch;patchdir=.. \
+            file://CVE-2026-59676.patch;patchdir=.. \
            "
 
 S = "${UNPACKDIR}/${BP}/sandbox"