diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a00808f7be6a..ce3e335e4729 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2284,10 +2284,12 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 		goto nodata;
 	size = SKB_WITH_OVERHEAD(size);
 
-	/* Copy only real data... and, alas, header. This should be
-	 * optimized for the cases when header is void.
+	/* Zero the headroom to avoid copying uninit memory.
+	 * Then copy only the actual packet data.
 	 */
-	memcpy(data + nhead, skb->head, skb_tail_pointer(skb) - skb->head);
+	memset(data, 0, nhead + skb_headroom(skb));
+	memcpy(data + nhead + skb_headroom(skb), skb->data,
+	       skb_tail_pointer(skb) - skb->data);
 
 	memcpy((struct skb_shared_info *)(data + size),
 	       skb_shinfo(skb),