--- x/net/xfrm/xfrm_state.c
+++ y/net/xfrm/xfrm_state.c
@@ -798,6 +798,7 @@ void xfrm_dev_state_free(struct xfrm_sta
 void __xfrm_state_destroy(struct xfrm_state *x)
 {
 	WARN_ON(x->km.state != XFRM_STATE_DEAD);
+	WARN_ON(!hlist_unhashed(&x->bydst));
 
 	spin_lock_bh(&xfrm_state_gc_lock);
 	hlist_add_head(&x->gclist, &xfrm_state_gc_list);