diff --git a/qemu-fix-msr-count-potential-segfault.patch b/qemu-fix-msr-count-potential-segfault.patch
new file mode 100644
index 0000000..c9f92bc
--- /dev/null
+++ b/qemu-fix-msr-count-potential-segfault.patch
@@ -0,0 +1,67 @@
+From 7834349cfcc68b946c0d241ffd99c598857e489b Mon Sep 17 00:00:00 2001
+From: Eduardo Habkost <ehabkost@redhat.com>
+Date: Wed, 14 Oct 2009 15:02:27 -0300
+Subject: [PATCH] fix MSR_COUNT for kvm_arch_save_regs()
+
+A new register was added to the load/save list on commit
+d283d5a65a2bdcc570065267be21848bd6fe3d78, but MSR_COUNT was not updated, leading
+to potential stack corruption on kvm_arch_save_regs().
+
+The following registers are saved by kvm_arch_save_regs():
+
+ 1) MSR_IA32_SYSENTER_CS
+ 2) MSR_IA32_SYSENTER_ESP
+ 3) MSR_IA32_SYSENTER_EIP
+ 4) MSR_STAR
+ 5) MSR_IA32_TSC
+ 6) MSR_VM_HSAVE_PA
+ 7) MSR_CSTAR (x86_64 only)
+ 8) MSR_KERNELGSBASE (x86_64 only)
+ 9) MSR_FMASK (x86_64 only)
+10) MSR_LSTAR (x86_64 only)
+
+(cherry picked from commit e7e5448ba387adc20be1cf08411a5b526d684299)
+
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+Fedora-patch: qemu-fix-msr-count-potential-segfault.patch
+---
+ qemu-kvm-x86.c |    6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/qemu-kvm-x86.c b/qemu-kvm-x86.c
+index 492dbc5..d5436b6 100644
+--- a/qemu-kvm-x86.c
++++ b/qemu-kvm-x86.c
+@@ -847,9 +847,9 @@ static int get_msr_entry(struct kvm_msr_entry *entry, CPUState *env)
+ }
+ 
+ #ifdef TARGET_X86_64
+-#define MSR_COUNT 9
++#define MSR_COUNT 10
+ #else
+-#define MSR_COUNT 5
++#define MSR_COUNT 6
+ #endif
+ 
+ static void set_v8086_seg(struct kvm_segment *lhs, const SegmentCache *rhs)
+@@ -991,6 +991,7 @@ void kvm_arch_load_regs(CPUState *env)
+ 
+     /* msrs */
+     n = 0;
++    /* Remember to increase MSR_COUNT if you add new registers below */
+     set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_CS,  env->sysenter_cs);
+     set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_ESP, env->sysenter_esp);
+     set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_EIP, env->sysenter_eip);
+@@ -1166,6 +1167,7 @@ void kvm_arch_save_regs(CPUState *env)
+ 
+     /* msrs */
+     n = 0;
++    /* Remember to increase MSR_COUNT if you add new registers below */
+     msrs[n++].index = MSR_IA32_SYSENTER_CS;
+     msrs[n++].index = MSR_IA32_SYSENTER_ESP;
+     msrs[n++].index = MSR_IA32_SYSENTER_EIP;
+-- 
+1.6.2.5
+
diff --git a/qemu.spec b/qemu.spec
index af31534..e2000fe 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1,7 +1,7 @@
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 0.11.0
-Release: 6%{?dist}
+Release: 7%{?dist}
 # Epoch because we pushed a qemu-1.0 package
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
@@ -49,6 +49,9 @@ Patch08: qemu-improve-error-reporting-on-file-access.patch
 # Fix fs errors with virtio and qcow2 backing file (#524734)
 Patch09: qemu-fix-qcow2-backing-file-with-virtio.patch
 
+# Fix potential segfault from too small MSR_COUNT (#528901)
+Patch10: qemu-fix-msr-count-potential-segfault.patch
+
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: SDL-devel zlib-devel which texi2html gnutls-devel cyrus-sasl-devel
 BuildRequires: rsync dev86 iasl
@@ -245,6 +248,7 @@ such as kvmtrace and kvm_stat.
 %patch07 -p1
 %patch08 -p1
 %patch09 -p1
+%patch10 -p1
 
 %build
 # --build-id option is used fedora 8 onwards for giving info to the debug packages.
@@ -526,6 +530,9 @@ fi
 %{_mandir}/man1/qemu-img.1*
 
 %changelog
+* Mon Oct 19 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-7
+- Fix potential segfault from too small MSR_COUNT (#528901)
+
 * Fri Oct  9 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-6
 - Fix fs errors with virtio and qcow2 backing file (#524734)
 - Fix ksm initscript errors on kernel missing ksm (#527653)