diff --git a/0089-DESKPROFILE-Fix-Improper-use-of-negative-value.patch b/0089-DESKPROFILE-Fix-Improper-use-of-negative-value.patch
new file mode 100644
index 0000000..9754a22
--- /dev/null
+++ b/0089-DESKPROFILE-Fix-Improper-use-of-negative-value.patch
@@ -0,0 +1,35 @@
+From 0633e97cfd6a696c19e19219e3de1cda7c7ee7b4 Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Mon, 19 Feb 2018 17:56:32 +0100
+Subject: [PATCH] DESKPROFILE: Fix 'Improper use of negative value'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This issue was found by Coverity. Similar as in code block before ret
+must be set to errno to allow proper log messages since initial ret will
+always be -1.
+
+Related to:
+https://pagure.io/SSSD/sssd/issue/3621
+
+Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
+---
+ src/providers/ipa/ipa_deskprofile_rules_util.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/providers/ipa/ipa_deskprofile_rules_util.c b/src/providers/ipa/ipa_deskprofile_rules_util.c
+index e52587378c3420eca1059fe123a6c878700fe69a..8f4d4c90cf0cf9ee2b05eca67e44b4cd7dfdb6ed 100644
+--- a/src/providers/ipa/ipa_deskprofile_rules_util.c
++++ b/src/providers/ipa/ipa_deskprofile_rules_util.c
+@@ -1065,6 +1065,7 @@ done:
+     if (getegid() != orig_gid) {
+         ret = setegid(orig_gid);
+         if (ret == -1) {
++            ret = errno;
+             DEBUG(SSSDBG_CRIT_FAILURE,
+                   "Unable to set effective user id (%"PRIu32") of the "
+                   "domain's process [%d]: %s\n",
+-- 
+2.16.1
+
diff --git a/sssd.spec b/sssd.spec
index b6c7c86..335c123 100644
--- a/sssd.spec
+++ b/sssd.spec
@@ -34,7 +34,7 @@
 
 Name: sssd
 Version: 1.16.0
-Release: 12%{?dist}
+Release: 13%{?dist}
 Group: Applications/System
 Summary: System Security Services Daemon
 License: GPLv3+
@@ -129,6 +129,7 @@ Patch0085: 0085-DESKPROFILE-Fix-the-permissions-and-soften-the-umask.patch
 Patch0086: 0086-DESKPROFILE-Use-seteuid-setegid-to-create-the-profil.patch
 Patch0087: 0087-DESKPROFILE-Use-seteuid-setegid-to-delete-the-profil.patch
 Patch0088: 0088-DESKPROFILE-Set-the-profile-permissions-to-read-only.patch
+Patch0089: 0089-DESKPROFILE-Fix-Improper-use-of-negative-value.patch
 
 Patch0502: 0502-SYSTEMD-Use-capabilities.patch
 Patch0503: 0503-Disable-stopping-idle-socket-activated-responders.patch
@@ -1331,6 +1332,9 @@ fi
                                 %{_libdir}/%{name}/modules/libwbclient.so
 
 %changelog
+* Tue Feb 20 2018 Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.16.0-13
+- Resolves: upstream#3621 - backport bug found by static analyzers
+
 * Wed Feb 14 2018 Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.0-12
 - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                            with no specific host/hostgroup set