diff --git a/qemu.spec b/qemu.spec
index 88097a8..a570dfd 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -228,6 +228,10 @@ Patch0215: json-Fix-a-memleak-in-parse_pair.patch
 Patch0216: tests-Disalbe-filemonitor-testcase.patch
 Patch0217: hostmem-Fix-up-free-host_nodes-list-right-after-visi.patch
 Patch0218: slirp-check-pkt_len-before-reading-protocol-header.patch
+Patch0219: hw-usb-hcd-ohci-check-for-processed-TD-before-retire.patch
+Patch0220: hw-ehci-check-return-value-of-usb_packet_map.patch
+Patch0221: hw-usb-hcd-ohci-check-len-and-frame_number-variables.patch
+Patch0222: hw-net-e1000e-advance-desc_offset-in-case-of-null-de.patch
 
 BuildRequires: flex
 BuildRequires: bison
@@ -573,6 +577,12 @@ getent passwd qemu >/dev/null || \
 %endif
 
 %changelog
+* Wed Nov 11 2020 Huawei Technologies Co., Ltd <alex.chen@huawei.com>
+- hw: usb: hcd-ohci: check for processed TD before retire
+- hw: ehci: check return value of 'usb_packet_map'
+- hw: usb: hcd-ohci: check len and frame_number variables
+- hw/net/e1000e: advance desc_offset in case of null descriptor
+
 * Fri Dec 11 2020 Huawei Technologies Co., Ltd <alex.chen@huawei.com>
 - slirp: check pkt_len before reading protocol header for fixing CVE-2020-29129 and CVE-2020-29130