diff --git a/kernel.spec b/kernel.spec
index 6566d32..8093948 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -48,7 +48,7 @@ Summary: The Linux kernel
 # reset this by hand to 1 (or to 0 and then use rpmdev-bumpspec).
 # scripts/rebase.sh should be made to do that for you, actually.
 #
-%global baserelease 48
+%global baserelease 49
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -705,6 +705,7 @@ Patch2917: hdpvr-ir-enable.patch
 Patch2918: linux-2.6-v4l-dvb-ir-core-update-2.patch
 Patch2919: linux-2.6-v4l-dvb-ir-core-update-3.patch
 Patch2920: linux-2.6-lirc-ioctl-compat-fixups.patch
+Patch2923: linux-2.6-v4l-dvb-ir-core-fix-imon.patch
 
 Patch2950: linux-2.6-via-velocity-dma-fix.patch
 
@@ -1370,6 +1371,7 @@ ApplyPatch hdpvr-ir-enable.patch
 ApplyPatch linux-2.6-v4l-dvb-ir-core-update-2.patch
 ApplyPatch linux-2.6-v4l-dvb-ir-core-update-3.patch
 ApplyPatch linux-2.6-lirc-ioctl-compat-fixups.patch
+ApplyPatch linux-2.6-v4l-dvb-ir-core-fix-imon.patch
 
 # Fix DMA bug on via-velocity
 ApplyPatch linux-2.6-via-velocity-dma-fix.patch
@@ -2039,6 +2041,9 @@ fi
 # and build.
 
 %changelog
+* Sat Oct 23 2010 Jarod Wilson <jarod@redhat.com> 2.6.35.6-49
+- Fix brown paper bag bug in imon driver
+
 * Fri Oct 22 2010 Chuck Ebbert <cebbert@redhat.com> 2.6.35.6-48
 - drm-i915-sanity-check-pread-pwrite.patch;
    fix CVE-2010-2962, arbitrary kernel memory write via i915 GEM ioctl
diff --git a/linux-2.6-v4l-dvb-ir-core-fix-imon.patch b/linux-2.6-v4l-dvb-ir-core-fix-imon.patch
new file mode 100644
index 0000000..48be947
--- /dev/null
+++ b/linux-2.6-v4l-dvb-ir-core-fix-imon.patch
@@ -0,0 +1,76 @@
+From: Jarod Wilson <jarod@redhat.com>
+Date: Sat, 23 Oct 2010 19:42:20 +0000 (-0300)
+Subject: [media] imon: fix my egregious brown paper bag w/rdev/idev split
+X-Git-Url: http://git.linuxtv.org/media_tree.git?a=commitdiff_plain;h=428cc7633dedbab05aab80b805d8585572dc6dbf
+
+[media] imon: fix my egregious brown paper bag w/rdev/idev split
+
+Somehow, I managed to screw things up when reworking the rdev/idev split
+patch from David, and started trying to get ir_input_dev from idev
+instead of rdev, thus resulting in button presses hanging the system.
+This fixes it.
+
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+---
+
+diff --git a/drivers/media/IR/imon.c b/drivers/media/IR/imon.c
+index 0391c3b..bcb2826 100644
+--- a/drivers/media/IR/imon.c
++++ b/drivers/media/IR/imon.c
+@@ -1477,7 +1477,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
+ 	bool norelease = false;
+ 	int i;
+ 	u64 scancode;
+-	struct input_dev *idev = NULL;
++	struct input_dev *rdev = NULL;
+ 	struct ir_input_dev *irdev = NULL;
+ 	int press_type = 0;
+ 	int msec;
+@@ -1485,8 +1485,8 @@ static void imon_incoming_packet(struct imon_context *ictx,
+ 	static struct timeval prev_time = { 0, 0 };
+ 	u8 ktype;
+ 
+-	idev = ictx->idev;
+-	irdev = input_get_drvdata(idev);
++	rdev = ictx->rdev;
++	irdev = input_get_drvdata(rdev);
+ 
+ 	/* filter out junk data on the older 0xffdc imon devices */
+ 	if ((buf[0] == 0xff) && (buf[1] == 0xff) && (buf[2] == 0xff))
+@@ -1570,8 +1570,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
+ 		if (press_type == 0)
+ 			ir_keyup(irdev);
+ 		else {
+-			ir_keydown(ictx->rdev, ictx->rc_scancode,
+-				   ictx->rc_toggle);
++			ir_keydown(rdev, ictx->rc_scancode, ictx->rc_toggle);
+ 			spin_lock_irqsave(&ictx->kc_lock, flags);
+ 			ictx->last_keycode = ictx->kc;
+ 			spin_unlock_irqrestore(&ictx->kc_lock, flags);
+@@ -1587,7 +1586,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
+ 		do_gettimeofday(&t);
+ 		msec = tv2int(&t, &prev_time);
+ 		prev_time = t;
+-		if (msec < idev->rep[REP_DELAY]) {
++		if (msec < ictx->idev->rep[REP_DELAY]) {
+ 			spin_unlock_irqrestore(&ictx->kc_lock, flags);
+ 			return;
+ 		}
+@@ -1596,12 +1595,12 @@ static void imon_incoming_packet(struct imon_context *ictx,
+ 
+ 	spin_unlock_irqrestore(&ictx->kc_lock, flags);
+ 
+-	input_report_key(idev, kc, press_type);
+-	input_sync(idev);
++	input_report_key(ictx->idev, kc, press_type);
++	input_sync(ictx->idev);
+ 
+ 	/* panel keys don't generate a release */
+-	input_report_key(idev, kc, 0);
+-	input_sync(idev);
++	input_report_key(ictx->idev, kc, 0);
++	input_sync(ictx->idev);
+ 
+ 	ictx->last_keycode = kc;
+