diff --git a/src/wps/wps.h b/src/wps/wps.h
index f30625509..a4b732308 100644
--- a/src/wps/wps.h
+++ b/src/wps/wps.h
@@ -450,6 +450,7 @@ union wps_event_data {
 	 */
 	struct wps_event_fail {
 		int msg;
+		u16 config_error;
 	} fail;
 
 	struct wps_event_pwd_auth_fail {
diff --git a/src/wps/wps_common.c b/src/wps/wps_common.c
index 82e6311c6..1897af32e 100644
--- a/src/wps/wps_common.c
+++ b/src/wps/wps_common.c
@@ -255,7 +255,8 @@ unsigned int wps_generate_pin(void)
 }
 
 
-void wps_fail_event(struct wps_context *wps, enum wps_msg_type msg)
+void wps_fail_event(struct wps_context *wps, enum wps_msg_type msg,
+		    u16 config_error)
 {
 	union wps_event_data data;
 
@@ -264,6 +265,7 @@ void wps_fail_event(struct wps_context *wps, enum wps_msg_type msg)
 
 	os_memset(&data, 0, sizeof(data));
 	data.fail.msg = msg;
+	data.fail.config_error = config_error;
 	wps->event_cb(wps->cb_ctx, WPS_EV_FAIL, &data);
 }
 
diff --git a/src/wps/wps_enrollee.c b/src/wps/wps_enrollee.c
index 1db255d19..e9d0e88ff 100644
--- a/src/wps/wps_enrollee.c
+++ b/src/wps/wps_enrollee.c
@@ -1151,21 +1151,21 @@ static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
 			return WPS_FAILURE;
 		ret = wps_process_m4(wps, msg, &attr);
 		if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
-			wps_fail_event(wps->wps, WPS_M4);
+			wps_fail_event(wps->wps, WPS_M4, wps->config_error);
 		break;
 	case WPS_M6:
 		if (wps_validate_m6(msg) < 0)
 			return WPS_FAILURE;
 		ret = wps_process_m6(wps, msg, &attr);
 		if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
-			wps_fail_event(wps->wps, WPS_M6);
+			wps_fail_event(wps->wps, WPS_M6, wps->config_error);
 		break;
 	case WPS_M8:
 		if (wps_validate_m8(msg) < 0)
 			return WPS_FAILURE;
 		ret = wps_process_m8(wps, msg, &attr);
 		if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
-			wps_fail_event(wps->wps, WPS_M8);
+			wps_fail_event(wps->wps, WPS_M8, wps->config_error);
 		break;
 	default:
 		wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",
@@ -1241,6 +1241,7 @@ static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
 						 const struct wpabuf *msg)
 {
 	struct wps_parse_attr attr;
+	u16 config_error;
 
 	wpa_printf(MSG_DEBUG, "WPS: Received WSC_NACK");
 
@@ -1285,18 +1286,19 @@ static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
 		return WPS_FAILURE;
 	}
 
+	config_error = WPA_GET_BE16(attr.config_error);
 	wpa_printf(MSG_DEBUG, "WPS: Registrar terminated negotiation with "
-		   "Configuration Error %d", WPA_GET_BE16(attr.config_error));
+		   "Configuration Error %d", config_error);
 
 	switch (wps->state) {
 	case RECV_M4:
-		wps_fail_event(wps->wps, WPS_M3);
+		wps_fail_event(wps->wps, WPS_M3, config_error);
 		break;
 	case RECV_M6:
-		wps_fail_event(wps->wps, WPS_M5);
+		wps_fail_event(wps->wps, WPS_M5, config_error);
 		break;
 	case RECV_M8:
-		wps_fail_event(wps->wps, WPS_M7);
+		wps_fail_event(wps->wps, WPS_M7, config_error);
 		break;
 	default:
 		break;
diff --git a/src/wps/wps_i.h b/src/wps/wps_i.h
index 88074a8e7..e0f28bb19 100644
--- a/src/wps/wps_i.h
+++ b/src/wps/wps_i.h
@@ -212,7 +212,8 @@ void wps_derive_psk(struct wps_data *wps, const u8 *dev_passwd,
 		    size_t dev_passwd_len);
 struct wpabuf * wps_decrypt_encr_settings(struct wps_data *wps, const u8 *encr,
 					  size_t encr_len);
-void wps_fail_event(struct wps_context *wps, enum wps_msg_type msg);
+void wps_fail_event(struct wps_context *wps, enum wps_msg_type msg,
+		    u16 config_error);
 void wps_success_event(struct wps_context *wps);
 void wps_pwd_auth_fail_event(struct wps_context *wps, int enrollee, int part);
 void wps_pbc_overlap_event(struct wps_context *wps);
diff --git a/src/wps/wps_registrar.c b/src/wps/wps_registrar.c
index 1beea75e0..7da374a45 100644
--- a/src/wps/wps_registrar.c
+++ b/src/wps/wps_registrar.c
@@ -2638,21 +2638,21 @@ static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
 			return WPS_FAILURE;
 		ret = wps_process_m3(wps, msg, &attr);
 		if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
-			wps_fail_event(wps->wps, WPS_M3);
+			wps_fail_event(wps->wps, WPS_M3, wps->config_error);
 		break;
 	case WPS_M5:
 		if (wps_validate_m5(msg) < 0)
 			return WPS_FAILURE;
 		ret = wps_process_m5(wps, msg, &attr);
 		if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
-			wps_fail_event(wps->wps, WPS_M5);
+			wps_fail_event(wps->wps, WPS_M5, wps->config_error);
 		break;
 	case WPS_M7:
 		if (wps_validate_m7(msg) < 0)
 			return WPS_FAILURE;
 		ret = wps_process_m7(wps, msg, &attr);
 		if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
-			wps_fail_event(wps->wps, WPS_M7);
+			wps_fail_event(wps->wps, WPS_M7, wps->config_error);
 		break;
 	default:
 		wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",
@@ -2743,6 +2743,7 @@ static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
 {
 	struct wps_parse_attr attr;
 	int old_state;
+	u16 config_error;
 
 	wpa_printf(MSG_DEBUG, "WPS: Received WSC_NACK");
 
@@ -2790,21 +2791,22 @@ static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
 		return WPS_FAILURE;
 	}
 
+	config_error = WPA_GET_BE16(attr.config_error);
 	wpa_printf(MSG_DEBUG, "WPS: Enrollee terminated negotiation with "
-		   "Configuration Error %d", WPA_GET_BE16(attr.config_error));
+		   "Configuration Error %d", config_error);
 
 	switch (old_state) {
 	case RECV_M3:
-		wps_fail_event(wps->wps, WPS_M2);
+		wps_fail_event(wps->wps, WPS_M2, config_error);
 		break;
 	case RECV_M5:
-		wps_fail_event(wps->wps, WPS_M4);
+		wps_fail_event(wps->wps, WPS_M4, config_error);
 		break;
 	case RECV_M7:
-		wps_fail_event(wps->wps, WPS_M6);
+		wps_fail_event(wps->wps, WPS_M6, config_error);
 		break;
 	case RECV_DONE:
-		wps_fail_event(wps->wps, WPS_M8);
+		wps_fail_event(wps->wps, WPS_M8, config_error);
 		break;
 	default:
 		break;
@@ -2987,7 +2989,8 @@ enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
 		ret = wps_process_wsc_done(wps, msg);
 		if (ret == WPS_FAILURE) {
 			wps->state = SEND_WSC_NACK;
-			wps_fail_event(wps->wps, WPS_WSC_DONE);
+			wps_fail_event(wps->wps, WPS_WSC_DONE,
+				       wps->config_error);
 		}
 		return ret;
 	default:
diff --git a/wpa_supplicant/wps_supplicant.c b/wpa_supplicant/wps_supplicant.c
index 003366520..b9e72764a 100644
--- a/wpa_supplicant/wps_supplicant.c
+++ b/wpa_supplicant/wps_supplicant.c
@@ -391,7 +391,8 @@ static void wpa_supplicant_wps_event_m2d(struct wpa_supplicant *wpa_s,
 static void wpa_supplicant_wps_event_fail(struct wpa_supplicant *wpa_s,
 					  struct wps_event_fail *fail)
 {
-	wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_FAIL "msg=%d", fail->msg);
+	wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_FAIL "msg=%d config_error=%d",
+		fail->msg, fail->config_error);
 	wpas_clear_wps(wpa_s);
 	wpas_notify_wps_event_fail(wpa_s, fail);
 }