diff --git a/include/lib/cpus/aarch64/denver.h b/include/lib/cpus/aarch64/denver.h
index f145fbb..712a4a4 100644
--- a/include/lib/cpus/aarch64/denver.h
+++ b/include/lib/cpus/aarch64/denver.h
@@ -20,6 +20,14 @@
 /* CPU state ids - implementation defined */
 #define DENVER_CPU_STATE_POWER_DOWN	U(0x3)
 
+/* Speculative store buffering */
+#define DENVER_CPU_DIS_SSB_EL3		(U(1) << 11)
+#define DENVER_PN4_CPU_DIS_SSB_EL3	(U(1) << 18)
+
+/* Speculative memory disambiguation */
+#define DENVER_CPU_DIS_MD_EL3		(U(1) << 9)
+#define DENVER_PN4_CPU_DIS_MD_EL3	(U(1) << 17)
+
 /* Core power management states */
 #define DENVER_CPU_PMSTATE_C1		U(0x1)
 #define DENVER_CPU_PMSTATE_C6		U(0x6)
diff --git a/lib/cpus/aarch64/denver.S b/lib/cpus/aarch64/denver.S
index c873f2e..c377b28 100644
--- a/lib/cpus/aarch64/denver.S
+++ b/lib/cpus/aarch64/denver.S
@@ -211,6 +211,15 @@
 	ret
 endfunc check_errata_cve_2017_5715
 
+func check_errata_cve_2018_3639
+#if WORKAROUND_CVE_2018_3639
+	mov	x0, #ERRATA_APPLIES
+#else
+	mov	x0, #ERRATA_MISSING
+#endif
+	ret
+endfunc check_errata_cve_2018_3639
+
 	/* -------------------------------------------------
 	 * The CPU Ops reset function for Denver.
 	 * -------------------------------------------------
@@ -236,6 +245,25 @@
 	msr	vbar_el3, x0
 #endif
 
+#if WORKAROUND_CVE_2018_3639
+	/*
+	 * Denver CPUs with DENVER_MIDR_PN3 or earlier, use different
+	 * bits in the ACTLR_EL3 register to disable speculative
+	 * store buffer and memory disambiguation.
+	 */
+	mrs	x0, midr_el1
+	mov_imm	x1, DENVER_MIDR_PN4
+	cmp	x0, x1
+	mrs	x0, actlr_el3
+	mov	x1, #(DENVER_CPU_DIS_MD_EL3 | DENVER_CPU_DIS_SSB_EL3)
+	mov	x2, #(DENVER_PN4_CPU_DIS_MD_EL3 | DENVER_PN4_CPU_DIS_SSB_EL3)
+	csel	x3, x1, x2, ne
+	orr	x0, x0, x3
+	msr	actlr_el3, x0
+	isb
+	dsb	sy
+#endif
+
 	/* ----------------------------------------------------
 	 * Reset ACTLR.PMSTATE to C1 state
 	 * ----------------------------------------------------
@@ -294,6 +322,7 @@
 	 * checking functions of each errata.
 	 */
 	report_errata WORKAROUND_CVE_2017_5715, denver, cve_2017_5715
+	report_errata WORKAROUND_CVE_2018_3639, denver, cve_2018_3639
 
 	ldp	x8, x30, [sp], #16
 	ret