diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index ca7e77e842835a6d153891fdca7dc8f196e0a2ba..254de32031296abc05d107e1d1261593ab7a6cc6 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -528,6 +528,9 @@ static int ip6erspan_rcv(struct sk_buff *skb,
        struct ip6_tnl *tunnel;
        u8 ver;
 
+       if (!pskb_may_pull(skb, sizeof(*ershdr)))
+               return PACKET_REJECT;
+
        ipv6h = ipv6_hdr(skb);
        ershdr = (struct erspan_base_hdr *)skb->data;
        ver = ershdr->ver;