diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 10ba439968f7..f28ba8a703fe 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -83,7 +83,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
 	long ret;
 
 	ret = -EINVAL;
-	if (plen > 1024 * 1024 - 1)
+	if (plen > 1024 * 1024 - 1 || plen < 48)
 		goto error;
 
 	/* draw all the data into kernel space */