diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6a7c02b7653a..48f676411724 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4782,10 +4782,13 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
 		else
 			tail->next = nskb;
 
-		if (unlikely(err)) {
-			nskb->next = list_skb;
+		/* nskb may be a clone with a NULL ->next: keep the remaining
+		 * members linked so that err_linearize frees them.
+		 */
+		nskb->next = list_skb;
+
+		if (unlikely(err))
 			goto err_linearize;
-		}
 
 		tail = nskb;