diff --git a/NetworkManager.spec b/NetworkManager.spec
index c4c1d8c..c6df96f 100644
--- a/NetworkManager.spec
+++ b/NetworkManager.spec
@@ -19,7 +19,7 @@ Name: NetworkManager
 Summary: Network connection manager and user applications
 Epoch: 1
 Version: 0.9.9.0
-Release: 22%{snapshot}%{?dist}
+Release: 23%{snapshot}%{?dist}
 Group: System Environment/Base
 License: GPLv2+
 URL: http://www.gnome.org/projects/NetworkManager/
@@ -49,6 +49,7 @@ Patch19: rh1034921-startup-link-wait.patch
 Patch20: rh1029213-ignore-RA-default-routes.patch
 Patch21: rh1032819-set-broadcast-address.patch
 Patch22: rh1044757-ipv6-solicit-infinity.patch
+Patch23: rh1048711-bluez-crash.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -194,6 +195,7 @@ deployments.
 %patch20 -p1 -b .ignore-RA-default-routes
 %patch21 -p1 -b .broadcast-addr
 %patch22 -p1 -b .ipv6-solicit-infinity
+%patch23 -p1 -b .bluez-crash
 
 %build
 
@@ -392,6 +394,9 @@ fi
 %config %{_sysconfdir}/%{name}/conf.d/00-server.conf
 
 %changelog
+* Mon Jan  6 2014 Dan Winship <danw@redhat.com> - 0.9.9.0-23.git20131003
+- bluez-manager: fix a crash (rh #1048711)
+
 * Thu Dec 19 2013 Dan Williams <dcbw@redhat.com> - 0.9.9.0-22.git20131003
 - core: fix IPv6 router solicitation loop (rh #1044757)
 
diff --git a/rh1048711-bluez-crash.patch b/rh1048711-bluez-crash.patch
new file mode 100644
index 0000000..f8b7457
--- /dev/null
+++ b/rh1048711-bluez-crash.patch
@@ -0,0 +1,21 @@
+diff -up NetworkManager-0.9.9.0/src/bluez-manager/nm-bluez-device.c.bluez-crash NetworkManager-0.9.9.0/src/bluez-manager/nm-bluez-device.c
+--- NetworkManager-0.9.9.0/src/bluez-manager/nm-bluez-device.c.bluez-crash	2013-10-03 15:00:51.000000000 -0400
++++ NetworkManager-0.9.9.0/src/bluez-manager/nm-bluez-device.c	2014-01-06 12:09:14.449583005 -0500
+@@ -686,7 +686,7 @@ static void
+ on_adapter_acquired (GObject *object, GAsyncResult *res, NMBluezDevice *self)
+ {
+ 	NMBluezDevicePrivate *priv = NM_BLUEZ_DEVICE_GET_PRIVATE (self);
+-	GError *error;
++	GError *error = NULL;
+ 	GVariant *v;
+ 
+ 	priv->adapter = g_dbus_proxy_new_for_bus_finish (res, &error);
+@@ -923,7 +923,7 @@ static void
+ on_proxy_acquired (GObject *object, GAsyncResult *res, NMBluezDevice *self)
+ {
+ 	NMBluezDevicePrivate *priv = NM_BLUEZ_DEVICE_GET_PRIVATE (self);
+-	GError *error;
++	GError *error = NULL;
+ 
+ 	priv->proxy5 = g_dbus_proxy_new_for_bus_finish (res, &error);
+