diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 449eeeb80fdefd1c4e585fef8d1e2d9ee1b447ec..6bb6373e6041ce2be5d5f6a0b4d1da1c26ce805b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -266,6 +266,9 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
 
 	itn = net_generic(net, erspan_net_id);
 
+	if (unlikely(!pskb_may_pull(skb, gre_hdr_len + sizeof(*ershdr))))
+		return PACKET_REJECT;
+
 	iph = ip_hdr(skb);
 	ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
 	ver = ershdr->ver;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index d864e3a41a9adb2ed403b2179ecd0b7bf6b0d000..3ac775eddf4d16345cdef23dd20928ad95d4234e 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -551,6 +551,9 @@ static int ip6erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
 	struct ip6_tnl *tunnel;
 	u8 ver;
 
+	if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr))))
+		return PACKET_REJECT;
+
 	ipv6h = ipv6_hdr(skb);
 	ershdr = (struct erspan_base_hdr *)skb->data;
 	ver = ershdr->ver;