diff --git a/0002-wifi-avoid-crash-reusing-supplicant-rh1298007.patch b/0002-wifi-avoid-crash-reusing-supplicant-rh1298007.patch
new file mode 100644
index 0000000..b704943
--- /dev/null
+++ b/0002-wifi-avoid-crash-reusing-supplicant-rh1298007.patch
@@ -0,0 +1,42 @@
+From dd8ee9be472ddf799e63e035bf0c82f072dc1881 Mon Sep 17 00:00:00 2001
+From: Thomas Haller <thaller@redhat.com>
+Date: Thu, 21 Jan 2016 15:03:44 +0100
+Subject: [PATCH 1/1] wifi: assert against returning cached
+ NMSupplicantInterface instances
+
+nm_supplicant_manager_iface_get() returning a cached instance leads to
+a crash when the first owner releases the object, as no ownership is
+transferred.
+
+That was fixed on master by commit f1fba3eb02c5d102a1b0e85c371dce81e5bd0d3b.
+Instead of backporting the entire refactoring (which also asserts against
+reuse), just disallow reusing here.
+
+The assertion should not be hit. If it would we need to investigate.
+Also, this way the assertion avoids a hard crash.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1298007
+(cherry picked from commit bd27102277e5d7e52d87bd26711ae6c431e08192)
+---
+ src/supplicant-manager/nm-supplicant-manager.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/supplicant-manager/nm-supplicant-manager.c b/src/supplicant-manager/nm-supplicant-manager.c
+index 083f2eb..e31e726 100644
+--- a/src/supplicant-manager/nm-supplicant-manager.c
++++ b/src/supplicant-manager/nm-supplicant-manager.c
+@@ -93,7 +93,10 @@ nm_supplicant_manager_iface_get (NMSupplicantManager * self,
+ 			                     iface);
+ 		}
+ 	} else {
+-		nm_log_dbg (LOGD_SUPPLICANT, "(%s): returning existing supplicant interface", ifname);
++		/* nm_supplicant_manager_iface_get() and release() implements no form of ref-counting
++		 * to properly handle reusing a cached instance. It's also unclear whether that is
++		 * even necessary or desired. Assert here and error out (rh #1298007). */
++		g_return_val_if_reached (NULL);
+ 	}
+ 
+ 	return iface;
+-- 
+2.5.0
+
diff --git a/NetworkManager.spec b/NetworkManager.spec
index 398b962..a993d08 100644
--- a/NetworkManager.spec
+++ b/NetworkManager.spec
@@ -8,7 +8,7 @@
 %define ppp_version %(rpm -q ppp-devel >/dev/null && rpm -q --qf '%%{version}' ppp-devel || echo -n bad)
 
 %define snapshot %{nil}
-%define release_version 2
+%define release_version 3
 %define realversion 1.0.10
 %define epoch_version 1
 
@@ -88,6 +88,7 @@ Patch0: 0000-explain-dns1-dns2.patch
 
 # nm-1-0 backports
 Patch1: 0001-rh1294309-peer-device-route.patch
+Patch2: 0002-wifi-avoid-crash-reusing-supplicant-rh1298007.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -365,6 +366,7 @@ by nm-connection-editor and nm-applet in a non-graphical environment.
 %setup -q -n NetworkManager-%{realversion}
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
 
 %build
 
@@ -683,6 +685,9 @@ fi
 %endif
 
 %changelog
+* Wed Mar  2 2016 Thomas Haller <thaller@rehdat.com> - 1:1.0.10-3
+- wifi: avoid crash when reusing supplicant instance (rh #1298007, rh #1241198)
+
 * Tue Jan  5 2016 Thomas Haller <thaller@redhat.com> - 1:1.0.10-2
 - routes: fix handling device-routes for IPv4 peer-addresses (rh #1294309)