diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index c6b3a4bcc8..450ea548be 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -503,6 +503,8 @@ Release 2.4.0 - UNRELEASED
     HADOOP-10147  HDFS-5678 Upgrade to commons-logging 1.1.3 to avoid potential
     deadlock in MiniDFSCluster (stevel)
 
+    HADOOP-10207. TestUserGroupInformation#testLogin is flaky (jxiang via cmccabe)
+
 Release 2.3.0 - UNRELEASED
 
   INCOMPATIBLE CHANGES
diff --git a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestUserGroupInformation.java b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestUserGroupInformation.java
index 0a303d0e88..35568c2883 100644
--- a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestUserGroupInformation.java
+++ b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestUserGroupInformation.java
@@ -738,7 +738,7 @@ public class TestUserGroupInformation {
       long groups) throws InterruptedException {
     MetricsRecordBuilder rb = getMetrics("UgiMetrics");
     if (groups > 0) {
-      assertCounter("GetGroupsNumOps", groups, rb);
+      assertCounterGt("GetGroupsNumOps", groups-1, rb);
       double avg = getDoubleGauge("GetGroupsAvgTime", rb);
       assertTrue(avg >= 0.0);