diff --git a/qemu.spec b/qemu.spec
index 7e2dc4d19d6906dde9995bd194c0e78bcc9078c9..58b785ee8c9dd356bc76f84010db75d11e0fbe6c 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1,6 +1,6 @@
 Name: qemu
 Version: 4.1.0
-Release: 46
+Release: 47
 Epoch: 2
 Summary: QEMU is a generic and open source machine emulator and virtualizer
 License: GPLv2 and BSD and MIT and CC-BY
@@ -250,6 +250,7 @@ Patch0237: usb-limit-combined-packets-to-1-MiB-CVE-2021-3527.patch
 Patch0238: hw-net-rocker_of_dpa-fix-double-free-bug-of-rocker-d.patch
 Patch0239: usbredir-fix-free-call.patch
 Patch0240: hw-arm-virt-Init-PMU-for-hotplugged-vCPU.patch
+Patch0241: uas-add-stream-number-sanity-checks.patch
 
 BuildRequires: flex
 BuildRequires: bison
@@ -595,6 +596,9 @@ getent passwd qemu >/dev/null || \
 %endif
 
 %changelog
+* Thu Sep 16 2021 Chen Qun <kuhn.chenqun@huawei.com>
+- uas: add stream number sanity checks.
+
 * Tue Aug 31 2021 imxcc <xingchaochao@huawei.com>
 - hw/arm/virt: Init PMU for hotplugged vCPU
 
diff --git a/uas-add-stream-number-sanity-checks.patch b/uas-add-stream-number-sanity-checks.patch
new file mode 100644
index 0000000000000000000000000000000000000000..66ed6c402524796360d058a4f5bad6cc325aedbc
--- /dev/null
+++ b/uas-add-stream-number-sanity-checks.patch
@@ -0,0 +1,61 @@
+From a6873a3381570900a43fa1642ab273f640a765a6 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 18 Aug 2021 14:05:05 +0200
+Subject: [PATCH] uas: add stream number sanity checks.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The device uses the guest-supplied stream number unchecked, which can
+lead to guest-triggered out-of-band access to the UASDevice->data3 and
+UASDevice->status3 fields.  Add the missing checks.
+
+Fixes: CVE-2021-3713
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reported-by: Chen Zhe <chenzhe@huawei.com>
+Reported-by: Tan Jingguo <tanjingguo@huawei.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-Id: <20210818120505.1258262-2-kraxel@redhat.com>
+---
+ hw/usb/dev-uas.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
+index abd8070d0c..82bbc0d083 100644
+--- a/hw/usb/dev-uas.c
++++ b/hw/usb/dev-uas.c
+@@ -827,6 +827,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p)
+         }
+         break;
+     case UAS_PIPE_ID_STATUS:
++        if (p->stream > UAS_MAX_STREAMS) {
++            goto err_stream;
++        }
+         if (p->stream) {
+             QTAILQ_FOREACH(st, &uas->results, next) {
+                 if (st->stream == p->stream) {
+@@ -854,6 +857,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p)
+         break;
+     case UAS_PIPE_ID_DATA_IN:
+     case UAS_PIPE_ID_DATA_OUT:
++        if (p->stream > UAS_MAX_STREAMS) {
++            goto err_stream;
++        }
+         if (p->stream) {
+             req = usb_uas_find_request(uas, p->stream);
+         } else {
+@@ -889,6 +895,11 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p)
+         p->status = USB_RET_STALL;
+         break;
+     }
++
++err_stream:
++    error_report("%s: invalid stream %d", __func__, p->stream);
++    p->status = USB_RET_STALL;
++    return;
+ }
+ 
+ static void usb_uas_unrealize(USBDevice *dev, Error **errp)
+-- 
+2.27.0
+