diff --git a/package/mac80211/patches/405-b43_locking_fix.patch b/package/mac80211/patches/405-b43_locking_fix.patch
new file mode 100644
index 0000000000..c90890a7a7
--- /dev/null
+++ b/package/mac80211/patches/405-b43_locking_fix.patch
@@ -0,0 +1,23 @@
+Subject: [PATCH] b43: work around a locking issue in ->set_tim()
+
+ops->set_tim() must be atomic, so b43 trying to acquire a mutex leads
+to a kernel crash. This patch trades an easy to trigger crash in AP
+mode for an unlikely race condition. According to Michael, the real
+fix would be to allow set_tim() callbacks to sleep, since b43 is
+not the only driver that needs to sleep in all callbacks.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -4534,9 +4534,8 @@ static int b43_op_beacon_set_tim(struct 
+ {
+ 	struct b43_wl *wl = hw_to_b43_wl(hw);
+ 
+-	mutex_lock(&wl->mutex);
++	/* FIXME: add locking */
+ 	b43_update_templates(wl);
+-	mutex_unlock(&wl->mutex);
+ 
+ 	return 0;
+ }