diff --git a/target/linux/generic/patches-4.4/100-ARM-work-around-CONFIG_CPU_SW_DOMAIN_PAN-breakage-on.patch b/target/linux/generic/patches-4.4/100-ARM-work-around-CONFIG_CPU_SW_DOMAIN_PAN-breakage-on.patch
new file mode 100644
index 0000000000..3156a54fee
--- /dev/null
+++ b/target/linux/generic/patches-4.4/100-ARM-work-around-CONFIG_CPU_SW_DOMAIN_PAN-breakage-on.patch
@@ -0,0 +1,44 @@
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 19 Jan 2016 00:18:09 +0100
+Subject: [PATCH] ARM: work around CONFIG_CPU_SW_DOMAIN_PAN breakage on ARM11
+ MPCore
+
+Patch taken from http://www.spinics.net/lists/arm-kernel/msg450888.html
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+---
+
+--- a/arch/arm/kernel/smp_tlb.c
++++ b/arch/arm/kernel/smp_tlb.c
+@@ -9,6 +9,7 @@
+  */
+ #include <linux/preempt.h>
+ #include <linux/smp.h>
++#include <linux/uaccess.h>
+ 
+ #include <asm/smp_plat.h>
+ #include <asm/tlbflush.h>
+@@ -40,8 +41,11 @@ static inline void ipi_flush_tlb_mm(void
+ static inline void ipi_flush_tlb_page(void *arg)
+ {
+ 	struct tlb_args *ta = (struct tlb_args *)arg;
++	unsigned int __ua_flags = uaccess_save_and_enable();
+ 
+ 	local_flush_tlb_page(ta->ta_vma, ta->ta_start);
++
++	uaccess_restore(__ua_flags);
+ }
+ 
+ static inline void ipi_flush_tlb_kernel_page(void *arg)
+@@ -54,8 +58,11 @@ static inline void ipi_flush_tlb_kernel_
+ static inline void ipi_flush_tlb_range(void *arg)
+ {
+ 	struct tlb_args *ta = (struct tlb_args *)arg;
++	unsigned int __ua_flags = uaccess_save_and_enable();
+ 
+ 	local_flush_tlb_range(ta->ta_vma, ta->ta_start, ta->ta_end);
++
++	uaccess_restore(__ua_flags);
+ }
+ 
+ static inline void ipi_flush_tlb_kernel_range(void *arg)