diff --git a/src/boot/linux_x86.c b/src/boot/linux_x86.c
index cf9707a6cfd..349e3fb26c0 100644
--- a/src/boot/linux_x86.c
+++ b/src/boot/linux_x86.c
@@ -195,9 +195,14 @@ EFI_STATUS linux_exec_efi_handover(
 
         /* Setup size is determined by offset 0x0202 + byte value at offset 0x0201, which is the same as
          * offset of the header field and the target from the jump field (which we split for this reason). */
+        size_t setup_hdr_len;
+        if (!ADD_SAFE(&setup_hdr_len, offsetof(SetupHeader, header), image_params->hdr.setup_size))
+                setup_hdr_len = sizeof(SetupHeader);
+        else
+                setup_hdr_len = MIN(setup_hdr_len, sizeof(SetupHeader));
         memcpy(&boot_params->hdr,
                &image_params->hdr,
-               offsetof(SetupHeader, header) + image_params->hdr.setup_size);
+               setup_hdr_len);
 
         boot_params->hdr.type_of_loader = 0xff;