diff --git a/0001-Fix-libinput_device_group_find_group-to-return-NULL-.patch b/0001-Fix-libinput_device_group_find_group-to-return-NULL-.patch
new file mode 100644
index 0000000..26f385e
--- /dev/null
+++ b/0001-Fix-libinput_device_group_find_group-to-return-NULL-.patch
@@ -0,0 +1,31 @@
+From 9949d4ee0859ef8361afc00363a941ff3d133d88 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 2 Nov 2015 08:46:25 +1000
+Subject: [PATCH libinput] Fix libinput_device_group_find_group() to return
+ NULL on failure
+
+struct list isn't a null-terminated list, list_for_each() causes 'g' to be set
+to the list head at the end of the loop. Returning that as group caused random
+memory to be overwritten.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/libinput.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/libinput.c b/src/libinput.c
+index f5c75b0..24f2b69 100644
+--- a/src/libinput.c
++++ b/src/libinput.c
+@@ -2011,7 +2011,7 @@ libinput_device_group_find_group(struct libinput *libinput,
+ 		}
+ 	}
+ 
+-	return g;
++	return NULL;
+ }
+ 
+ void
+-- 
+2.4.3
+
diff --git a/libinput.spec b/libinput.spec
index 075a90c..5cb8eb3 100644
--- a/libinput.spec
+++ b/libinput.spec
@@ -5,7 +5,7 @@
 
 Name:           libinput
 Version:        1.1.0
-Release:        2%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
+Release:        3%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
 Summary:        Input device library
 
 License:        MIT
@@ -26,6 +26,7 @@ Patch03:        0002-evdev-log-a-bug-for-missing-pointer-accel-on-relativ.patch
 Patch04:        0003-evdev-don-t-handle-motion-events-if-the-device-isn-t.patch
 Patch05:        0004-evdev-init-pointer-acceleration-for-any-device-with-.patch
 Patch06:        0005-test-add-Asus-RoG-Gladius-mouse.patch
+Patch07:        0001-Fix-libinput_device_group_find_group-to-return-NULL-.patch
 
 BuildRequires:  git
 BuildRequires:  autoconf automake libtool pkgconfig
@@ -103,6 +104,9 @@ find $RPM_BUILD_ROOT -name '*.la' -delete
 
 
 %changelog
+* Mon Nov 02 2015 Peter Hutterer <peter.hutterer@redhat.com> 1.1.0-3
+- Fix invalid device group pointer, causing invalid memory access
+
 * Wed Oct 28 2015 Peter Hutterer <peter.hutterer@redhat.com> 1.1.0-2
 - Fix crash triggered by Asus RoG Gladius mouse (#1275407)