diff --git a/debian/changelog b/debian/changelog
index 1f452893e..f5b243a1e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -31,6 +31,7 @@ linux (3.10.4-1) UNRELEASED; urgency=low
   * [sparc] cpufreq: Convince genksyms that the ABI didn't change
     (fixes FTBFS)
   * [hppa] udeb: Add core-modules package (Closes: #718270)
+  * nl80211: fix another nl80211_fam.attrbuf race
 
  -- Ben Hutchings <ben@decadent.org.uk>  Tue, 30 Jul 2013 18:09:20 +0200
 
diff --git a/debian/patches/bugfix/all/nl80211-fix-another-nl80211_fam-attrbuf-race.patch b/debian/patches/bugfix/all/nl80211-fix-another-nl80211_fam-attrbuf-race.patch
new file mode 100644
index 000000000..0a40950b6
--- /dev/null
+++ b/debian/patches/bugfix/all/nl80211-fix-another-nl80211_fam-attrbuf-race.patch
@@ -0,0 +1,38 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 30 Jul 2013 22:38:42 +0200
+Subject: nl80211: fix another nl80211_fam.attrbuf race
+Origin: https://git.kernel.org/cgit/linux/kernel/git/jberg/mac80211.git/commit/?id=c319d50bfcf678c2857038276d9fab3c6646f3bf
+
+This is similar to the race Linus had reported, but in this case
+it's an older bug: nl80211_prepare_wdev_dump() uses the wiphy
+index in cb->args[0] as it is and thus parses the message over
+and over again instead of just once because 0 is the first valid
+wiphy index. Similar code in nl80211_testmode_dump() correctly
+offsets the wiphy_index by 1, do that here as well.
+
+Cc: stable@vger.kernel.org
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/wireless/nl80211.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 25d217d..3fcba69 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -441,10 +441,12 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
+ 			goto out_unlock;
+ 		}
+ 		*rdev = wiphy_to_dev((*wdev)->wiphy);
+-		cb->args[0] = (*rdev)->wiphy_idx;
++		/* 0 is the first index - add 1 to parse only once */
++		cb->args[0] = (*rdev)->wiphy_idx + 1;
+ 		cb->args[1] = (*wdev)->identifier;
+ 	} else {
+-		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
++		/* subtract the 1 again here */
++		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
+ 		struct wireless_dev *tmp;
+ 
+ 		if (!wiphy) {
diff --git a/debian/patches/series b/debian/patches/series
index 10592a7c7..206884cf5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -112,3 +112,4 @@ features/all/iwlwifi-bump-required-firmware-API-version-for-3160-.patch
 bugfix/m68k/ethernat-kconfig.patch
 
 debian/sparc-cpufreq-convince-genksyms-that-the-abi-didnt-change.patch
+bugfix/all/nl80211-fix-another-nl80211_fam-attrbuf-race.patch