diff --git a/net/key/af_key.c b/net/key/af_key.c
index 71cb44cebaf7..fd80164c9af7 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -493,6 +493,9 @@ static int parse_exthdrs(struct sk_buff *skb, const struct sadb_msg *hdr, void *
 		uint16_t ext_type;
 		int ext_len;
 
+		if (len < sizeof(*ehdr))
+			return -EINVAL;
+
 		ext_len  = ehdr->sadb_ext_len;
 		ext_len *= sizeof(uint64_t);
 		ext_type = ehdr->sadb_ext_type;