--- a/net/6lowpan/iphc.c	2026-09-09 17:39:32.246999220 -0700
+++ b/net/6lowpan/iphc.c	2026-09-09 17:39:32.269520956 -0700
@@ -1140,6 +1140,10 @@
 	if (skb->protocol != htons(ETH_P_IPV6))
 		return -EINVAL;
 
+	/* Every field compressed below is read out of the IPv6 header. */
+	if (skb->len < sizeof(struct ipv6hdr))
+		return -EINVAL;
+
 	hdr = ipv6_hdr(skb);
 	hc_ptr = head + 2;
 
@@ -1299,7 +1303,11 @@
 	head[0] = iphc0;
 	head[1] = iphc1;
 
-	skb_pull(skb, sizeof(struct ipv6hdr));
+	/* NHC compression has already pulled the transport header, so the
+	 * IPv6 header may no longer be there to pull.
+	 */
+	if (!skb_pull(skb, sizeof(struct ipv6hdr)))
+		return -EINVAL;
 	skb_reset_transport_header(skb);
 	memcpy(skb_push(skb, hc_ptr - head), head, hc_ptr - head);
 	skb_reset_network_header(skb);