diff --git a/Misc/NEWS b/Misc/NEWS
index 6ed2c2c..058692f 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -383,6 +383,9 @@
 Extension Modules
 -----------------
 
+- Issue #8065: Fix memory leak in readline module (from failure to
+  free the result of history_get_history_state()).
+
 - Issue #9450: Fix memory leak in readline.replace_history_item and
   readline.remove_history_item for readline version >= 5.0.
 
diff --git a/Modules/readline.c b/Modules/readline.c
index e187129..53c6de2 100644
--- a/Modules/readline.c
+++ b/Modules/readline.c
@@ -490,6 +490,25 @@
 \n\
 Returns current completer function.");
 
+/* Private function to get current length of history.  XXX It may be
+ * possible to replace this with a direct use of history_length instead,
+ * but it's not clear whether BSD's libedit keeps history_length up to date.
+ * See issue #8065.*/
+
+static int
+_py_get_history_length(void)
+{
+    HISTORY_STATE *hist_st = history_get_history_state();
+    int length = hist_st->length;
+    /* the history docs don't say so, but the address of hist_st changes each
+       time history_get_history_state is called which makes me think it's
+       freshly malloc'd memory...  on the other hand, the address of the last
+       line stays the same as long as history isn't extended, so it appears to
+       be malloc'd but managed by the history package... */
+    free(hist_st);
+    return length;
+}
+
 /* Exported function to get any element of history */
 
 static PyObject *
@@ -517,10 +536,7 @@
 static PyObject *
 get_current_history_length(PyObject *self, PyObject *noarg)
 {
-    HISTORY_STATE *hist_st;
-
-    hist_st = history_get_history_state();
-    return PyLong_FromLong(hist_st ? (long) hist_st->length : (long) 0);
+    return PyLong_FromLong((long)_py_get_history_length());
 }
 
 PyDoc_STRVAR(doc_get_current_history_length,
@@ -1000,20 +1016,13 @@
     n = strlen(p);
     if (n > 0) {
         char *line;
-        HISTORY_STATE *state = history_get_history_state();
-        if (state->length > 0)
-            line = history_get(state->length)->line;
+        int length = _py_get_history_length();
+        if (length > 0)
+            line = history_get(length)->line;
         else
             line = "";
         if (strcmp(p, line))
             add_history(p);
-        /* the history docs don't say so, but the address of state
-           changes each time history_get_history_state is called
-           which makes me think it's freshly malloc'd memory...
-           on the other hand, the address of the last line stays the
-           same as long as history isn't extended, so it appears to
-           be malloc'd but managed by the history package... */
-        free(state);
     }
     /* Copy the malloc'ed buffer into a PyMem_Malloc'ed one and
        release the original. */