diff --git a/src/syscall/sockcmsg_linux.go b/src/syscall/sockcmsg_linux.go
index 5a56b25beb..4cb9075ba8 100644
--- a/src/syscall/sockcmsg_linux.go
+++ b/src/syscall/sockcmsg_linux.go
@@ -31,6 +31,9 @@ func ParseUnixCredentials(m *SocketControlMessage) (*Ucred, error) {
 	if m.Header.Type != SCM_CREDENTIALS {
 		return nil, EINVAL
 	}
+	if uintptr(len(m.Data)) < unsafe.Sizeof(Ucred{}) {
+		return nil, EINVAL
+	}
 	ucred := *(*Ucred)(unsafe.Pointer(&m.Data[0]))
 	return &ucred, nil
 }