diff --git a/kernel-module/nft_rtpengine.c b/kernel-module/nft_rtpengine.c
index 5c6972a4d..821d8def8 100644
--- a/kernel-module/nft_rtpengine.c
+++ b/kernel-module/nft_rtpengine.c
@@ -7154,7 +7154,7 @@ static int rtpengine46(struct sk_buff *oskb,
 			g->decrypt_rtp.cipher->name);
 
 	datalen = ntohs(uh->len);
-	if (datalen < sizeof(*uh))
+	if (datalen < sizeof(*uh) || datalen > oskb->len - (oskb->transport_header - oskb->network_header))
 		goto out_target;
 	datalen -= sizeof(*uh);
 	DBG("udp payload = %u\n", datalen);