diff --git a/SOURCES/openvswitch-2.15.0.patch b/SOURCES/openvswitch-2.15.0.patch
index f5637af..085bdce 100644
--- a/SOURCES/openvswitch-2.15.0.patch
+++ b/SOURCES/openvswitch-2.15.0.patch
@@ -20327,7 +20327,7 @@ index 4fda1220b0..45360dc3e1 100644
      /* Caches the masks to match a packet to, reducing runtime calculations. */
      uint64_t *mf_masks;
 diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c
-index 4381c618f1..fe0a81862a 100644
+index 4381c618f1..059d3baed6 100644
 --- a/lib/dpif-netdev.c
 +++ b/lib/dpif-netdev.c
 @@ -279,8 +279,9 @@ static bool dpcls_lookup(struct dpcls *cls,
@@ -20706,6 +20706,28 @@ index 4381c618f1..fe0a81862a 100644
          if (band_max_delta_t > meter->max_delta_t) {
              meter->max_delta_t = band_max_delta_t;
          }
+@@ -6451,15 +6466,15 @@ static struct dp_netdev_pmd_thread *
+ dp_netdev_get_pmd(struct dp_netdev *dp, unsigned core_id)
+ {
+     struct dp_netdev_pmd_thread *pmd;
+-    const struct cmap_node *pnode;
+ 
+-    pnode = cmap_find(&dp->poll_threads, hash_int(core_id, 0));
+-    if (!pnode) {
+-        return NULL;
++    CMAP_FOR_EACH_WITH_HASH (pmd, node, hash_int(core_id, 0),
++                             &dp->poll_threads) {
++        if (pmd->core_id == core_id) {
++            return dp_netdev_pmd_try_ref(pmd) ? pmd : NULL;
++        }
+     }
+-    pmd = CONTAINER_OF(pnode, struct dp_netdev_pmd_thread, node);
+ 
+-    return dp_netdev_pmd_try_ref(pmd) ? pmd : NULL;
++    return NULL;
+ }
+ 
+ /* Sets the 'struct dp_netdev_pmd_thread' for non-pmd threads. */
 @@ -8493,6 +8508,7 @@ const struct dpif_class dpif_netdev_class = {
      NULL,                       /* ct_timeout_policy_dump_next */
      NULL,                       /* ct_timeout_policy_dump_done */
@@ -24210,7 +24232,7 @@ index 114aff8ea3..0fc6d2ea60 100644
      enum xc_type type;
      union {
 diff --git a/ofproto/ofproto-dpif-xlate.c b/ofproto/ofproto-dpif-xlate.c
-index 7108c8a301..5425274e99 100644
+index 7108c8a301..2411d3d49b 100644
 --- a/ofproto/ofproto-dpif-xlate.c
 +++ b/ofproto/ofproto-dpif-xlate.c
 @@ -460,7 +460,7 @@ static void xlate_commit_actions(struct xlate_ctx *ctx);
@@ -24264,6 +24286,15 @@ index 7108c8a301..5425274e99 100644
  static struct xbundle *
  xbundle_lookup(struct xlate_cfg *xcfg, const struct ofbundle *ofbundle)
  {
+@@ -3015,7 +3032,7 @@ xlate_normal(struct xlate_ctx *ctx)
+     bool is_grat_arp = is_gratuitous_arp(flow, wc);
+     if (ctx->xin->allow_side_effects
+         && flow->packet_type == htonl(PT_ETH)
+-        && in_port->pt_mode != NETDEV_PT_LEGACY_L3
++        && in_port && in_port->pt_mode != NETDEV_PT_LEGACY_L3
+     ) {
+         update_learning_table(ctx, in_xbundle, flow->dl_src, vlan,
+                               is_grat_arp);
 @@ -3024,12 +3041,14 @@ xlate_normal(struct xlate_ctx *ctx)
          struct xc_entry *entry;
  
@@ -26331,7 +26362,7 @@ index 199db8ed0f..59093c03c9 100644
  bad_action 'fin_timeout(foo=bar)' "invalid key 'foo' in 'fin_timeout' argument"
  
 diff --git a/tests/ofproto-dpif.at b/tests/ofproto-dpif.at
-index 31064ed95e..c0217de004 100644
+index 31064ed95e..9ca18a4107 100644
 --- a/tests/ofproto-dpif.at
 +++ b/tests/ofproto-dpif.at
 @@ -81,11 +81,12 @@ recirc_id(0),in_port(4),packet_type(ns=0,id=0),eth(src=50:54:00:00:00:0b,dst=ff:
@@ -26645,7 +26676,45 @@ index 31064ed95e..c0217de004 100644
  AT_SETUP([ofproto-dpif - exit])
  OVS_VSWITCHD_START
  add_of_ports br0 1 2 3 10 11 12 13 14
-@@ -7349,7 +7473,7 @@ dnl configure bridge IPFIX and ensure that sample action generation works at the
+@@ -5449,7 +5573,36 @@ check_flows () {
+     echo "n_packets=$n"
+     test "$n" = 1
+ }
+-OVS_WAIT_UNTIL([check_flows], [ovs dump-flows br0])
++OVS_WAIT_UNTIL([check_flows], [ovs-ofctl dump-flows br0])
++
++OVS_VSWITCHD_STOP
++AT_CLEANUP
++
++# Checks for regression against a bug in which OVS crashed
++# with in_port=OFPP_NONE or in_port=OFPP_CONTROLLER and
++# recirculation is involved.
++AT_SETUP([ofproto-dpif - packet-out recirculation with OFPP_NONE and OFPP_CONTROLLER])
++OVS_VSWITCHD_START
++add_of_ports br0 1 2
++
++AT_DATA([flows.txt], [dnl
++table=0 ip actions=mod_dl_dst:83:83:83:83:83:83,ct(table=1)
++table=1 ip actions=ct(commit),normal
++])
++AT_CHECK([ovs-ofctl add-flows br0 flows.txt])
++
++packet=ffffffffffff00102030405008004500001c00000000401100000a000002ffffffff0035111100080000
++AT_CHECK([ovs-ofctl packet-out br0 "in_port=none,packet=$packet actions=table"])
++AT_CHECK([ovs-ofctl packet-out br0 "in_port=controller,packet=$packet actions=table"])
++
++# Dumps out the flow table, extracts the number of packets that have gone
++# through the (single) flow in table 1, and returns success if it's exactly 2.
++check_flows () {
++    n=$(ovs-ofctl dump-flows br0 table=1 | sed -n 's/.*n_packets=\([[0-9]]\{1,\}\).*/\1/p')
++    echo "n_packets=$n"
++    test "$n" = 2
++}
++OVS_WAIT_UNTIL([check_flows], [ovs-ofctl dump-flows br0])
+ 
+ OVS_VSWITCHD_STOP
+ AT_CLEANUP
+@@ -7349,7 +7502,7 @@ dnl configure bridge IPFIX and ensure that sample action generation works at the
  dnl datapath level.
  AT_SETUP([ofproto-dpif - Bridge IPFIX sanity check])
  OVS_VSWITCHD_START
@@ -26654,7 +26723,7 @@ index 31064ed95e..c0217de004 100644
  
  dnl Sample every packet using bridge-based sampling.
  AT_CHECK([ovs-vsctl -- set bridge br0 ipfix=@fix -- \
-@@ -7365,6 +7489,28 @@ flow-dump from the main thread:
+@@ -7365,6 +7518,28 @@ flow-dump from the main thread:
  packets:2, bytes:68, used:0.001s, actions:userspace(pid=0,ipfix(output_port=4294967295))
  ])
  
@@ -26683,7 +26752,7 @@ index 31064ed95e..c0217de004 100644
  AT_CHECK([ovs-appctl revalidator/purge])
  dnl
  dnl Add a slowpath meter. The userspace action should be metered.
-@@ -8416,6 +8562,34 @@ AT_CHECK([sed -n 's/=[[0-9]][[0-9]]\(\.[[0-9]][[0-9]]*\)\{0,1\}s/=?s/p' stdout],
+@@ -8416,6 +8591,34 @@ AT_CHECK([sed -n 's/=[[0-9]][[0-9]]\(\.[[0-9]][[0-9]]*\)\{0,1\}s/=?s/p' stdout],
  OVS_VSWITCHD_STOP
  AT_CLEANUP
  
@@ -26718,7 +26787,7 @@ index 31064ed95e..c0217de004 100644
  dnl ----------------------------------------------------------------------
  AT_BANNER([ofproto-dpif -- megaflows])
  
-@@ -9520,6 +9694,26 @@ OFPST_TABLE reply (OF1.3) (xid=0x2):
+@@ -9520,6 +9723,26 @@ OFPST_TABLE reply (OF1.3) (xid=0x2):
  OVS_VSWITCHD_STOP
  AT_CLEANUP
  
@@ -26745,7 +26814,7 @@ index 31064ed95e..c0217de004 100644
  AT_SETUP([ofproto-dpif - ICMPv6])
  OVS_VSWITCHD_START
  add_of_ports br0 1
-@@ -10842,6 +11036,31 @@ dnl
+@@ -10842,6 +11065,31 @@ dnl
  NXT_PACKET_IN (xid=0x0): table_id=1 cookie=0x0 total_len=106 in_port=2 (via action) data_len=106 (unbuffered)
  udp,vlan_tci=0x0000,dl_src=50:54:00:00:00:0a,dl_dst=50:54:00:00:00:09,nw_src=10.1.1.2,nw_dst=10.1.1.1,nw_tos=0,nw_ecn=0,nw_ttl=64,tp_src=2,tp_dst=1 udp_csum:553
  ])
@@ -26777,7 +26846,7 @@ index 31064ed95e..c0217de004 100644
  OVS_VSWITCHD_STOP
  AT_CLEANUP
  
-@@ -11204,6 +11423,23 @@ Megaflow: recirc_id=0x3,eth,ip,in_port=1,nw_frag=no
+@@ -11204,6 +11452,23 @@ Megaflow: recirc_id=0x3,eth,ip,in_port=1,nw_frag=no
  Datapath actions: 4
  ])
  
diff --git a/SPECS/openvswitch2.15.spec b/SPECS/openvswitch2.15.spec
index 57fe669..d980151 100644
--- a/SPECS/openvswitch2.15.spec
+++ b/SPECS/openvswitch2.15.spec
@@ -57,7 +57,7 @@ Summary: Open vSwitch
 Group: System Environment/Daemons daemon/database/utilities
 URL: http://www.openvswitch.org/
 Version: 2.15.0
-Release: 89%{?dist}
+Release: 90%{?dist}
 
 # Nearly all of openvswitch is ASL 2.0.  The bugtool is LGPLv2+, and the
 # lib/sflow*.[ch] files are SISSL
@@ -702,6 +702,13 @@ exit 0
 %endif
 
 %changelog
+* Tue Apr 05 2022 Open vSwitch CI <ovs-ci@redhat.com> - 2.15.0-90
+- Merging upstream branch-2.15 [RH git: 9e3e8cde3c]
+    Commit list:
+    80b57ee01f dpif-netdev: Fix dp_netdev_get_pmd() function getting correct core_id.
+    c1bbb1ec6d ofproto-dpif-xlate: Fix NULL pointer dereference in xlate_normal().
+
+
 * Wed Mar 30 2022 Open vSwitch CI <ovs-ci@redhat.com> - 2.15.0-89
 - Merging upstream branch-2.15 [RH git: c42b42c1dc]
     Commit list: