diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a00808f7be6a..7e493904d47a 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2284,9 +2284,10 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 		goto nodata;
 	size = SKB_WITH_OVERHEAD(size);
 
-	/* Copy only real data... and, alas, header. This should be
-	 * optimized for the cases when header is void.
+	/* Zero new and old headroom in the new buffer, then copy
+	 * original contents to preserve layout and header offsets.
 	 */
+	memset(data, 0, nhead + skb_headroom(skb));
 	memcpy(data + nhead, skb->head, skb_tail_pointer(skb) - skb->head);
 
 	memcpy((struct skb_shared_info *)(data + size),