diff --git a/tigervnc-sanity-check-when-cleaning-up-keymap-changes.patch b/tigervnc-sanity-check-when-cleaning-up-keymap-changes.patch
new file mode 100644
index 0000000..012a741
--- /dev/null
+++ b/tigervnc-sanity-check-when-cleaning-up-keymap-changes.patch
@@ -0,0 +1,28 @@
+From 774c6bcf33b5c9b94c1ff12895775e77c555decc Mon Sep 17 00:00:00 2001
+From: Pierre Ossman <ossman@cendio.se>
+Date: Thu, 9 Feb 2023 11:30:37 +0100
+Subject: [PATCH] Sanity check when cleaning up keymap changes
+
+Make sure we don't send a bogus request to the X server in the (common)
+case that we don't actually have anything to restore.
+
+(cherry picked from commit 1e3484f2017f038dd5149cd50741feaf39a680e4)
+---
+ unix/x0vncserver/XDesktop.cxx | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/unix/x0vncserver/XDesktop.cxx b/unix/x0vncserver/XDesktop.cxx
+index d5c6b2db9..f9c810968 100644
+--- a/unix/x0vncserver/XDesktop.cxx
++++ b/unix/x0vncserver/XDesktop.cxx
+@@ -481,6 +481,10 @@ void XDesktop::deleteAddedKeysyms(Display* dpy) {
+     }
+   }
+
++  // Did we actually find something to remove?
++  if (highestKeyCode < lowestKeyCode)
++    return;
++
+   changes.changed |= XkbKeySymsMask;
+   changes.first_key_sym = lowestKeyCode;
+   changes.num_key_syms = highestKeyCode - lowestKeyCode + 1;
diff --git a/tigervnc.spec b/tigervnc.spec
index 2a1607e..0a18cd4 100644
--- a/tigervnc.spec
+++ b/tigervnc.spec
@@ -5,7 +5,7 @@
 
 Name:           tigervnc
 Version:        1.12.0
-Release:        10%{?dist}
+Release:        11%{?dist}
 Summary:        A TigerVNC remote display system
 
 %global _hardened_build 1
@@ -33,15 +33,13 @@ Patch53:        tigervnc-vncsession-restore-script-systemd-service.patch
 Patch54:        tigervnc-fix-ghost-cursor-in-zaphod-mode.patch
 # https://github.com/TigerVNC/tigervnc/pull/1510
 Patch55:        tigervnc-add-new-keycodes-for-unknown-keysyms.patch
+Patch56:        tigervnc-sanity-check-when-cleaning-up-keymap-changes.patch
 
 # This is tigervnc-%%{version}/unix/xserver116.patch rebased on the latest xorg
 Patch100:       tigervnc-xserver120.patch
 # 1326867 - [RHEL7.3] GLX applications in an Xvnc session fails to start
 Patch101:       0001-rpath-hack.patch
 
-# CVE-2023-0494 tigervnc: xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
-Patch110:       xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
-
 BuildRequires:  make
 BuildRequires:  gcc-c++
 BuildRequires:  libX11-devel, automake, autoconf, libtool, gettext, gettext-autopoint
@@ -165,7 +163,6 @@ for all in `find . -type f -perm -001`; do
 done
 %patch100 -p1 -b .xserver120-rebased
 %patch101 -p1 -b .rpath
-%patch110 -p1 -b .Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
 popd
 
 %patch1 -p1 -b .use-gnome-as-default-session
@@ -177,6 +174,7 @@ popd
 %patch53 -p1 -b .vncsession-restore-script-systemd-service
 %patch54 -p1 -b .fix-ghost-cursor-in-zaphod-mode
 %patch55 -p1 -b .add-new-keycodes-for-unknown-keysyms
+%patch56 -p1 -b .sanity-check-when-cleaning-up-keymap-changes
 
 %build
 %ifarch sparcv9 sparc64 s390 s390x
@@ -355,6 +353,10 @@ fi
 %ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
 
 %changelog
+* Wed Feb 15 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-11
+- Add sanity check when cleaning up keymap changes
+  Resolves: bz#2169965
+
 * Mon Feb 06 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-10
 - xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
   Resolves: bz#2167061
diff --git a/xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch b/xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
deleted file mode 100644
index 2389895..0000000
--- a/xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 7150ba655c0cc08fa6ded309b81265bb672f2869 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Wed, 25 Jan 2023 11:41:40 +1000
-Subject: [PATCH xserver] Xi: fix potential use-after-free in
- DeepCopyPointerClasses
-
-CVE-2023-0494, ZDI-CAN 19596
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
----
- Xi/exevents.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/Xi/exevents.c b/Xi/exevents.c
-index 217baa9561..dcd4efb3bc 100644
---- a/Xi/exevents.c
-+++ b/Xi/exevents.c
-@@ -619,8 +619,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
-             memcpy(to->button->xkb_acts, from->button->xkb_acts,
-                    sizeof(XkbAction));
-         }
--        else
-+        else {
-             free(to->button->xkb_acts);
-+            to->button->xkb_acts = NULL;
-+        }
- 
-         memcpy(to->button->labels, from->button->labels,
-                from->button->numButtons * sizeof(Atom));
--- 
-2.39.0
-