diff --git a/1002-checkpoint-Fix-segfault-crash-when-rollback-rhel-1526.patch b/1002-checkpoint-Fix-segfault-crash-when-rollback-rhel-1526.patch
new file mode 100644
index 0000000..63671a3
--- /dev/null
+++ b/1002-checkpoint-Fix-segfault-crash-when-rollback-rhel-1526.patch
@@ -0,0 +1,67 @@
+From d9b3114b6ef8e0f4d50a8d56d750a698d85fa984 Mon Sep 17 00:00:00 2001
+From: Gris Ge <fge@redhat.com>
+Date: Tue, 29 Aug 2023 08:25:23 +0800
+Subject: [PATCH] checkpoint: Fix segfault crash when rollback
+
+When rolling back a checkpoint, NM will crash due to dereference a NULL
+pointer of `priv->removed_devices->len`.
+
+To fix it, we just place a NULL check before that code block.
+
+Fixes: 1f1b71ad9f8a ('checkpoint: preserve devices that were removed and
+                      readded')
+
+Reference: https://issues.redhat.com/browse/RHEL-1526
+
+Signed-off-by: Gris Ge <fge@redhat.com>
+(cherry picked from commit 3162507d6ca381cfbe02ceba2d80ba0f3ba3e5f7)
+(cherry picked from commit e5600d4c5a33749939b984184f27fbe4159a2b65)
+---
+ src/core/nm-checkpoint.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/src/core/nm-checkpoint.c b/src/core/nm-checkpoint.c
+index 5c4d4e53d6..74adf48477 100644
+--- a/src/core/nm-checkpoint.c
++++ b/src/core/nm-checkpoint.c
+@@ -460,24 +460,27 @@ next_dev:
+         NMDeviceState state;
+ 
+         nm_manager_for_each_device (priv->manager, device, tmp_lst) {
+-            gboolean found = FALSE;
+-
+             if (g_hash_table_contains(priv->devices, device))
+                 continue;
+ 
+             /* Also ignore devices that were in the checkpoint initially and
+              * were moved to 'removed_devices' because they got removed from
+              * the system. */
+-            for (i = 0; i < priv->removed_devices->len; i++) {
+-                dev_checkpoint = priv->removed_devices->pdata[i];
+-                if (dev_checkpoint->dev_type == nm_device_get_device_type(device)
+-                    && nm_streq0(dev_checkpoint->original_dev_name, nm_device_get_iface(device))) {
+-                    found = TRUE;
+-                    break;
++            if (priv->removed_devices) {
++                gboolean found = FALSE;
++
++                for (i = 0; i < priv->removed_devices->len; i++) {
++                    dev_checkpoint = priv->removed_devices->pdata[i];
++                    if (dev_checkpoint->dev_type == nm_device_get_device_type(device)
++                        && nm_streq0(dev_checkpoint->original_dev_name,
++                                     nm_device_get_iface(device))) {
++                        found = TRUE;
++                        break;
++                    }
+                 }
++                if (found)
++                    continue;
+             }
+-            if (found)
+-                continue;
+ 
+             state = nm_device_get_state(device);
+             if (state > NM_DEVICE_STATE_DISCONNECTED && state < NM_DEVICE_STATE_DEACTIVATING) {
+-- 
+2.41.0
+
diff --git a/NetworkManager.spec b/NetworkManager.spec
index 5ec1025..16f3c36 100644
--- a/NetworkManager.spec
+++ b/NetworkManager.spec
@@ -6,7 +6,7 @@
 %global epoch_version 1
 %global real_version 1.44.0
 %global rpm_version %{real_version}
-%global release_version 2
+%global release_version 3
 %global snapshot %{nil}
 %global git_sha %{nil}
 %global bcond_default_debug 0
@@ -203,6 +203,7 @@ Source7: readme-ifcfg-rh.txt
 
 # Bugfixes that are only relevant until next rebase of the package.
 Patch1001: 1001-nm-manager-ensure-device-is-exported-on-D-Bus-in-aut-rhbz2210271.patch
+Patch1002: 1002-checkpoint-Fix-segfault-crash-when-rollback-rhel-1526.patch
 
 Requires(post): systemd
 %if 0%{?fedora} || 0%{?rhel} >= 8
@@ -1252,6 +1253,9 @@ fi
 
 
 %changelog
+* Wed Aug 30 2023 Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.44.0-3 
+- checkpoint: Fix segfault crash when rollback (rhel-1526)
+
 * Wed Aug 23 2023 Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.44.0-2
 - manager: ensure device is exported on D-Bus in authentication request (rh #2210271)