diff --git a/kernel.spec b/kernel.spec
index 8564cc07e..e259974a2 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -770,6 +770,9 @@ Patch25077: media-cx23885-Fix-TeVii-S471-regression-since-introduction-of-ts2020
 #CVE-2013-0343 rhbz 914664 999380
 Patch25078: ipv6-remove-max_addresses-check-from-ipv6_create_tempaddr.patch
 
+#rhbz 1000679
+Patch25079: rt2800-rearrange-bbp-rfcsr-initialization.patch
+
 #CVE-2013-2888 rhbz 1000451 1002543 CVE-2013-2889 rhbz 999890 1002548
 #CVE-2013-2891 rhbz 999960 1002555  CVE-2013-2892 rhbz 1000429 1002570
 #CVE-2013-2893 rhbz 1000414 1002575 CVE-2013-2894 rhbz 1000137 1002579
@@ -1502,6 +1505,9 @@ ApplyPatch ipv6-remove-max_addresses-check-from-ipv6_create_tempaddr.patch
 #CVE-2013-2897 rhbz 1000536 1002600 CVE-2013-2899 rhbz 1000373 1002604
 ApplyPatch HID-CVE-fixes.patch
 
+#rhbz 1000679
+ApplyPatch rt2800-rearrange-bbp-rfcsr-initialization.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2314,6 +2320,9 @@ fi
 # and build.
 
 %changelog
+* Mon Sep 09 2013 Josh Boyer <jwboyer@fedoraproject.org>
+- Fix system freeze due to incorrect rt2800 initialization (rhbz 1000679)
+
 * Thu Sep 09 2013 Justin M. Forbes <jforbes@fedoraproject.org> 3.10.11-200
 - Linux v3.10.11
 
diff --git a/rt2800-rearrange-bbp-rfcsr-initialization.patch b/rt2800-rearrange-bbp-rfcsr-initialization.patch
new file mode 100644
index 000000000..c782fc5d4
--- /dev/null
+++ b/rt2800-rearrange-bbp-rfcsr-initialization.patch
@@ -0,0 +1,35 @@
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index 7e66a90..6a70c27 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -4041,8 +4041,7 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
+ 	u8 reg_id;
+ 	u8 value;
+ 
+-	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev) ||
+-		     rt2800_wait_bbp_ready(rt2x00dev)))
++	if (unlikely(rt2800_wait_bbp_ready(rt2x00dev)))
+ 		return -EACCES;
+ 
+ 	if (rt2x00_rt(rt2x00dev, RT5592)) {
+@@ -5185,15 +5184,17 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev)
+ 		     rt2800_init_registers(rt2x00dev)))
+ 		return -EIO;
+ 
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev)))
++		return -EIO;
++
+ 	/*
+ 	 * Send signal to firmware during boot time.
+ 	 */
+ 	rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+ 	rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+-	if (rt2x00_is_usb(rt2x00dev)) {
++	if (rt2x00_is_usb(rt2x00dev))
+ 		rt2800_register_write(rt2x00dev, H2M_INT_SRC, 0);
+-		rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
+-	}
++	rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
+ 	msleep(1);
+ 
+ 	if (unlikely(rt2800_init_bbp(rt2x00dev)))