diff --git a/dev-libs/libffi/files/libffi-3.4.8-pa-add-.note.GNU-stack-marker-to-linux.S.patch b/dev-libs/libffi/files/libffi-3.4.8-pa-add-.note.GNU-stack-marker-to-linux.S.patch
new file mode 100644
index 0000000000000..ac74106c2b56a
--- /dev/null
+++ b/dev-libs/libffi/files/libffi-3.4.8-pa-add-.note.GNU-stack-marker-to-linux.S.patch
@@ -0,0 +1,34 @@
+https://github.com/libffi/libffi/pull/899
+
+From 9991e8312b2cb4d1a9d0842ec9440c5e606f8cde Mon Sep 17 00:00:00 2001
+Message-ID: <9991e8312b2cb4d1a9d0842ec9440c5e606f8cde.1744688368.git.sam@gentoo.org>
+From: Sam James <sam@gentoo.org>
+Date: Tue, 15 Apr 2025 04:37:09 +0100
+Subject: [PATCH] pa: add .note.GNU-stack marker to linux.S
+
+Similarly to f515eac04cf8e5f594d5d9dee5fb7dfc3a186a4c, add a .note.GNU-stack
+marker to pa/linux.S as it doesn't need an executable stack. Absence of the
+note means that GNU Binutils will consider it as needing an executable stack
+and mark it as such automatically.
+
+Bug: https://bugs.gentoo.org/953805
+Bug: https://github.com/libffi/libffi/issues/898
+---
+ src/pa/linux.S | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/pa/linux.S b/src/pa/linux.S
+index 2d3b036..fdd4332 100644
+--- a/src/pa/linux.S
++++ b/src/pa/linux.S
+@@ -425,3 +425,7 @@ ffi_closure_pa32:
+ 
+ 	.align 4
+ .LEFDE2:
++
++#if defined(__ELF__) && defined(__linux__)
++.section .note.GNU-stack,"",%progbits
++#endif
+-- 
+2.49.0
+
diff --git a/dev-libs/libffi/libffi-3.4.8-r1.ebuild b/dev-libs/libffi/libffi-3.4.8-r1.ebuild
new file mode 100644
index 0000000000000..b53a7ca31e89c
--- /dev/null
+++ b/dev-libs/libffi/libffi-3.4.8-r1.ebuild
@@ -0,0 +1,87 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit multilib-minimal preserve-libs
+
+MY_PV=${PV/_rc/-rc}
+MY_P=${PN}-${MY_PV}
+
+DESCRIPTION="Portable, high level programming interface to various calling conventions"
+HOMEPAGE="https://sourceware.org/libffi/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/libffi/libffi"
+	inherit autotools git-r3
+else
+	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="MIT"
+# This is a core package which is depended on by e.g. Python.
+# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
+# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
+SLOT="0/8" # SONAME=libffi.so.8
+IUSE="debug +exec-static-trampoline pax-kernel static-libs test"
+
+RESTRICT="!test? ( test )"
+BDEPEND="test? ( dev-util/dejagnu )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.4.8-pa-add-.note.GNU-stack-marker-to-linux.S.patch
+)
+
+src_prepare() {
+	default
+
+	[[ ${PV} == 9999 ]] && eautoreconf
+
+	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
+		# ensure we use aarch64 asm, not x86 on arm64
+		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
+			configure configure.host || die
+	fi
+}
+
+multilib_src_configure() {
+	# --includedir= path maintains a few properties:
+	# 1. have stable name across libffi versions: some packages like
+	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
+	#    ${includedir} at build-time. Don't require those to be
+	#    rebuilt unless SONAME changes. bug #695788
+	#
+	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
+	#
+	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
+	#
+	#    We use /usr/$(get_libdir)/... to have ABI identifier.
+	ECONF_SOURCE="${S}" econf \
+		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
+		--disable-multi-os-directory \
+		$(use_enable static-libs static) \
+		$(use_enable exec-static-trampoline exec-static-tramp) \
+		$(use_enable pax-kernel pax_emutramp) \
+		$(use_enable debug)
+}
+
+multilib_src_test() {
+	emake -Onone check
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -name "*.la" -delete || die
+}
+
+pkg_preinst() {
+	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
+}
diff --git a/dev-libs/libffi/libffi-9999.ebuild b/dev-libs/libffi/libffi-9999.ebuild
index 072cb92af7430..b53a7ca31e89c 100644
--- a/dev-libs/libffi/libffi-9999.ebuild
+++ b/dev-libs/libffi/libffi-9999.ebuild
@@ -33,7 +33,7 @@ RESTRICT="!test? ( test )"
 BDEPEND="test? ( dev-util/dejagnu )"
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-3.4.7-Revert-Fix-x86-ffi64-calls-with-6-gp-and-some-sse-re.patch
+	"${FILESDIR}"/${PN}-3.4.8-pa-add-.note.GNU-stack-marker-to-linux.S.patch
 )
 
 src_prepare() {