diff -u xserver-xorg-input-evdev-2.2.5/debian/changelog xserver-xorg-input-evdev-2.2.5/debian/changelog
--- xserver-xorg-input-evdev-2.2.5/debian/changelog
+++ xserver-xorg-input-evdev-2.2.5/debian/changelog
@@ -1,3 +1,16 @@
+xserver-xorg-input-evdev (1:2.2.5-1ubuntu2) karmic; urgency=low
+
+  * Apply upstream patch from fd.org bug 23048 (LP: #343528)
+    Finalize the middle button emulation when a read error occurs (#23048)
+
+    If a read error occurs, remove the block and wakeup handlers for middle
+    mouse button emulation. Otherwise, they'll still be around after the device
+    has been reopened and overwritten with the new ones created by EvdevOn.
+    Once this happened, future removal of the device can lead to a server
+    crash.
+
+ -- Matt Zimmerman <mdz@ubuntu.com>  Sun, 11 Oct 2009 09:47:44 +0100
+
 xserver-xorg-input-evdev (1:2.2.5-1ubuntu1) karmic; urgency=low
 
   * Merge from debian unstable, remaining changes:
diff -u xserver-xorg-input-evdev-2.2.5/debian/patches/series xserver-xorg-input-evdev-2.2.5/debian/patches/series
--- xserver-xorg-input-evdev-2.2.5/debian/patches/series
+++ xserver-xorg-input-evdev-2.2.5/debian/patches/series
@@ -1,0 +2 @@
+lp343528-fd23048-EvdevMBEmuBlockHandler.patch
only in patch2:
unchanged:
--- xserver-xorg-input-evdev-2.2.5.orig/debian/patches/lp343528-fd23048-EvdevMBEmuBlockHandler.patch
+++ xserver-xorg-input-evdev-2.2.5/debian/patches/lp343528-fd23048-EvdevMBEmuBlockHandler.patch
@@ -0,0 +1,32 @@
+From 8dc2501caf5887063626d43602c214e1cdc75d81 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 6 Oct 2009 19:09:33 +1000
+Subject: [PATCH] Finalize the middle button emulation when a read error occurs (#23048)
+
+If a read error occurs, remove the block and wakeup handlers for middle
+mouse button emulation. Otherwise, they'll still be around after the device
+has been reopened and overwritten with the new ones created by EvdevOn. Once
+this happened, future removal of the device can lead to a server crash.
+
+X.Org Bug 23048 <http://bugs.freedesktop.org/show_bug.cgi?id=23048>
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/evdev.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/src/evdev.c b/src/evdev.c
+index da44450..1524a07 100644
+--- a/src/evdev.c
++++ b/src/evdev.c
+@@ -768,6 +768,7 @@ EvdevReadInput(InputInfoPtr pInfo)
+         {
+             if (errno == ENODEV) /* May happen after resume */
+             {
++                EvdevMBEmuFinalize(pInfo);
+                 xf86RemoveEnabledDevice(pInfo);
+                 close(pInfo->fd);
+                 pInfo->fd = -1;
+-- 
+1.6.3.rc1.2.g0164.dirty
+