--- x/drivers/atm/atmtcp.c
+++ y/drivers/atm/atmtcp.c
@@ -294,6 +294,8 @@ static int atmtcp_c_send(struct atm_vcc
 	dev = vcc->dev_data;
 	hdr = (struct atmtcp_hdr *) skb->data;
 	if (hdr->length == ATMTCP_HDR_MAGIC) {
+		if (skb->len < sizeof(struct atmtcp_control))
+			goto done;
 		result = atmtcp_recv_control(
 		    (struct atmtcp_control *) skb->data);
 		goto done;