diff --git a/glibc-rh1631728.patch b/glibc-rh1631728.patch
new file mode 100644
index 0000000..cc59bac
--- /dev/null
+++ b/glibc-rh1631728.patch
@@ -0,0 +1,82 @@
+commit 2339d6a55eb7a7e040ae888e906adc49eeb59eab
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Wed Sep 12 08:40:59 2018 -0700
+
+    i386: Use ENTRY and END in start.S [BZ #23606]
+    
+    Wrapping the _start function with ENTRY and END to insert ENDBR32 at
+    function entry when CET is enabled.  Since _start now includes CFI,
+    without "cfi_undefined (eip)", unwinder may not terminate at _start
+    and we will get
+    
+    Program received signal SIGSEGV, Segmentation fault.
+    0xf7dc661e in ?? () from /lib/libgcc_s.so.1
+    Missing separate debuginfos, use: dnf debuginfo-install libgcc-8.2.1-3.0.fc28.i686
+    (gdb) bt
+     #0  0xf7dc661e in ?? () from /lib/libgcc_s.so.1
+     #1  0xf7dc7c18 in _Unwind_Backtrace () from /lib/libgcc_s.so.1
+     #2  0xf7f0d809 in __GI___backtrace (array=array@entry=0xffffc7d0,
+        size=size@entry=20) at ../sysdeps/i386/backtrace.c:127
+     #3  0x08049254 in compare (p1=p1@entry=0xffffcad0, p2=p2@entry=0xffffcad4)
+        at backtrace-tst.c:12
+     #4  0xf7e2a28c in msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0,
+        n=n@entry=2) at msort.c:65
+     #5  0xf7e29f64 in msort_with_tmp (n=2, b=0xffffcad0, p=0xffffca5c)
+        at msort.c:53
+     #6  msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=5)
+        at msort.c:53
+     #7  0xf7e29f64 in msort_with_tmp (n=5, b=0xffffcad0, p=0xffffca5c)
+        at msort.c:53
+     #8  msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=10)
+        at msort.c:53
+     #9  0xf7e29f64 in msort_with_tmp (n=10, b=0xffffcad0, p=0xffffca5c)
+        at msort.c:53
+     #10 msort_with_tmp (p=p@entry=0xffffca5c, b=b@entry=0xffffcad0, n=n@entry=20)
+        at msort.c:53
+     #11 0xf7e2a5b6 in msort_with_tmp (n=20, b=0xffffcad0, p=0xffffca5c)
+        at msort.c:297
+     #12 __GI___qsort_r (b=b@entry=0xffffcad0, n=n@entry=20, s=s@entry=4,
+        cmp=cmp@entry=0x8049230 <compare>, arg=arg@entry=0x0) at msort.c:297
+     #13 0xf7e2a84d in __GI_qsort (b=b@entry=0xffffcad0, n=n@entry=20, s=s@entry=4,
+        cmp=cmp@entry=0x8049230 <compare>) at msort.c:308
+     #14 0x080490f6 in main (argc=2, argv=0xffffcbd4) at backtrace-tst.c:39
+    
+    FAIL: debug/backtrace-tst
+    
+            [BZ #23606]
+            * sysdeps/i386/start.S: Include <sysdep.h>
+            (_start): Use ENTRY/END to insert ENDBR32 at entry when CET is
+            enabled.  Add cfi_undefined (eip).
+    
+    Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+    
+    (cherry picked from commit 5a274db4ea363d6b0b92933f085a92daaf1be2f2)
+
+diff --git a/sysdeps/i386/start.S b/sysdeps/i386/start.S
+index 91035fa83fb7ee38..e35e9bd31b2cea30 100644
+--- a/sysdeps/i386/start.S
++++ b/sysdeps/i386/start.S
+@@ -52,10 +52,11 @@
+ 					NULL
+ */
+ 
+-	.text
+-	.globl _start
+-	.type _start,@function
+-_start:
++#include <sysdep.h>
++
++ENTRY (_start)
++	/* Clearing frame pointer is insufficient, use CFI.  */
++	cfi_undefined (eip)
+ 	/* Clear the frame pointer.  The ABI suggests this be done, to mark
+ 	   the outermost frame obviously.  */
+ 	xorl %ebp, %ebp
+@@ -131,6 +132,7 @@ _start:
+ 1:	movl	(%esp), %ebx
+ 	ret
+ #endif
++END (_start)
+ 
+ /* To fulfill the System V/i386 ABI we need this symbol.  Yuck, it's so
+    meaningless since we don't support machines < 80386.  */
diff --git a/glibc.spec b/glibc.spec
index dd7e518..17f72bb 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -1,6 +1,6 @@
 %define glibcsrcdir glibc-2.28
 %define glibcversion 2.28
-%define glibcrelease 14%{?dist}
+%define glibcrelease 15%{?dist}
 # Pre-release tarballs are pulled in from git using a command that is
 # effectively:
 #
@@ -171,6 +171,7 @@ Patch35: glibc-rh1631338-1.patch
 Patch36: glibc-rh1631338-2.patch
 Patch37: glibc-rh1623519.patch
 Patch38: glibc-rh1631719.patch
+Patch39: glibc-rh1631728.patch
 
 ##############################################################################
 # Continued list of core "glibc" package information:
@@ -1912,6 +1913,9 @@ fi
 %files -f compat-libpthread-nonshared.filelist -n compat-libpthread-nonshared
 
 %changelog
+* Wed Sep 26 2018 Florian Weimer <fweimer@redhat.com> - 2.28-15
+- Add missing ENDBR32 in start.S (#1631728)
+
 * Wed Sep 26 2018 Florian Weimer <fweimer@redhat.com> - 2.28-14
 - Fix bug in generic strstr with large needles (#1631719)