diff --git a/valgrind-3.9.0-timer_create.patch b/valgrind-3.9.0-timer_create.patch
new file mode 100644
index 0000000..769b355
--- /dev/null
+++ b/valgrind-3.9.0-timer_create.patch
@@ -0,0 +1,53 @@
+    BZ#331380 Syscall param timer_create(evp) points to uninitialised byte(s)
+    
+    Only check struct sigevent actually used by the kernel. If SIGEV_THREAD_ID
+    is set check sigev_notify_thread_id, otherwise don't.
+
+diff --git a/coregrind/m_syswrap/syswrap-linux.c b/coregrind/m_syswrap/syswrap-linux.c
+index 9dadd84..1a7fa6b 100644
+--- a/coregrind/m_syswrap/syswrap-linux.c
++++ b/coregrind/m_syswrap/syswrap-linux.c
+@@ -2175,8 +2175,18 @@ PRE(sys_timer_create)
+    PRE_REG_READ3(long, "timer_create",
+                  vki_clockid_t, clockid, struct sigevent *, evp,
+                  vki_timer_t *, timerid);
+-   if (ARG2 != 0)
+-      PRE_MEM_READ( "timer_create(evp)", ARG2, sizeof(struct vki_sigevent) );
++   if (ARG2 != 0) {
++      struct vki_sigevent *evp = (struct vki_sigevent *) ARG2;
++      PRE_MEM_READ( "timer_create(evp.sigev_value)", (Addr)&evp->sigev_value,
++                    sizeof(vki_sigval_t) );
++      PRE_MEM_READ( "timer_create(evp.sigev_signo)", (Addr)&evp->sigev_signo,
++                    sizeof(int) );
++      PRE_MEM_READ( "timer_create(evp.sigev_notify)", (Addr)&evp->sigev_notify,
++                    sizeof(int) );
++      if ((evp->sigev_notify & VKI_SIGEV_THREAD_ID) != 0)
++         PRE_MEM_READ( "timer_create(evp.sigev_notify_thread_id)",
++                       (Addr)&evp->vki_sigev_notify_thread_id, sizeof(int) );
++   }
+    PRE_MEM_WRITE( "timer_create(timerid)", ARG3, sizeof(vki_timer_t) );
+ }
+ POST(sys_timer_create)
+diff --git a/include/vki/vki-linux.h b/include/vki/vki-linux.h
+index 14bb8bf..a3c4b3c 100644
+--- a/include/vki/vki-linux.h
++++ b/include/vki/vki-linux.h
+@@ -544,6 +544,9 @@ typedef struct vki_siginfo {
+ #define VKI_SIGEV_PAD_SIZE	((VKI_SIGEV_MAX_SIZE - VKI___ARCH_SIGEV_PREAMBLE_SIZE) \
+ 		/ sizeof(int))
+ 
++/* This is the flag the kernel handles, userspace/glibc handles SEGEV_THEAD. */
++#define VKI_SIGEV_THREAD_ID	4
++
+ typedef struct vki_sigevent {
+ 	vki_sigval_t sigev_value;
+ 	int sigev_signo;
+@@ -559,6 +562,8 @@ typedef struct vki_sigevent {
+ 	} _sigev_un;
+ } vki_sigevent_t;
+ 
++#define vki_sigev_notify_thread_id	_sigev_un._tid
++
+ //----------------------------------------------------------------------
+ // From elsewhere...
+ //----------------------------------------------------------------------
diff --git a/valgrind.spec b/valgrind.spec
index dc701fa..2abdcf7 100644
--- a/valgrind.spec
+++ b/valgrind.spec
@@ -3,7 +3,7 @@
 Summary: Tool for finding memory management bugs in programs
 Name: %{?scl_prefix}valgrind
 Version: 3.9.0
-Release: 5%{?dist}
+Release: 6%{?dist}
 Epoch: 1
 License: GPLv2+
 URL: http://www.valgrind.org/
@@ -56,6 +56,9 @@ Patch13: valgrind-3.9.0-s390-fpr-pair.patch
 # KDE#331337 - s390x WARNING: unhandled syscall: 326 (dup3)
 Patch14: valgrind-3.9.0-s390-dup3.patch
 
+# KDE#331380 - Syscall param timer_create(evp) points to uninitialised byte(s)
+Patch15: valgrind-3.9.0-timer_create.patch
+
 %ifarch x86_64 ppc64
 # Ensure glibc{,-devel} is installed for both multilib arches
 BuildRequires: /lib/libc.so.6 /usr/lib/libc.so /lib64/libc.so.6 /usr/lib64/libc.so
@@ -162,6 +165,7 @@ Valgrind User Manual for details.
 %patch12 -p1
 %patch13 -p1
 %patch14 -p1
+%patch15 -p1
 
 %build
 # We need to use the software collection compiler and binutils if available.
@@ -315,8 +319,9 @@ echo ===============END TESTING===============
 %endif
 
 %changelog
-* Fri Feb 21 2014 Mark Wielaard <mjw@redhat.com>
+* Fri Feb 21 2014 Mark Wielaard <mjw@redhat.com> - 3.9.0-6
 - Add valgrind-3.9.0-s390-dup3.patch
+- Add valgrind-3.9.0-timer_create.patch
 
 * Thu Dec 12 2013 Mark Wielaard <mjw@redhat.com> - 3.9.0-5
 - Add valgrind-3.9.0-manpage-memcheck-options.patch.