diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 6b1a31a74cf2add02caf27ee4b9ee5cad35f30cc..ba9840195cf259d8f0a8cd406d8bf68cab1d9263 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -110,6 +110,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
 			if (!sg)
 				goto unlock;
 		}
+		sg_init_table(sg, nfrags);
 		skb_to_sgvec(skb, sg, esph->enc_data+esp->conf.ivlen-skb->data, clen);
 		err = crypto_blkcipher_encrypt(&desc, sg, sg, clen);
 		if (unlikely(sg != &esp->sgbuf[0]))
@@ -201,6 +202,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
 		if (!sg)
 			goto out;
 	}
+	sg_init_table(sg, nfrags);
 	skb_to_sgvec(skb, sg, sizeof(*esph) + esp->conf.ivlen, elen);
 	err = crypto_blkcipher_decrypt(&desc, sg, sg, elen);
 	if (unlikely(sg != &esp->sgbuf[0]))
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 72a659806cadfb4f7d026e10e6eef9df41f9e0ef..f67d51a4e56d319b1f7588956b0dd48e080eb06b 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -109,6 +109,7 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
 			if (!sg)
 				goto unlock;
 		}
+		sg_init_table(sg, nfrags);
 		skb_to_sgvec(skb, sg, esph->enc_data+esp->conf.ivlen-skb->data, clen);
 		err = crypto_blkcipher_encrypt(&desc, sg, sg, clen);
 		if (unlikely(sg != &esp->sgbuf[0]))
@@ -205,6 +206,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
 				goto out;
 			}
 		}
+		sg_init_table(sg, nfrags);
 		skb_to_sgvec(skb, sg, sizeof(*esph) + esp->conf.ivlen, elen);
 		ret = crypto_blkcipher_decrypt(&desc, sg, sg, elen);
 		if (unlikely(sg != &esp->sgbuf[0]))