diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index 2c9ae02ada3e0565d6fb535fc41929b52acaf3f1..4bef62fc9460fa5be87d75bcf11d4a325b665238 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -1142,6 +1142,11 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
 	struct sk_buff *skb;
 	int err, depth;
 
+	if (unlikely(xdp->data_end - xdp->data < ETH_HLEN)) {
+		err = -EINVAL;
+		goto err;
+	}
+
 	if (q->flags & IFF_VNET_HDR)
 		vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz);