diff --git a/target/linux/generic/hack-4.14/950-fix-crash-nf_xfrm_me_harder.patch b/target/linux/generic/hack-4.14/950-fix-crash-nf_xfrm_me_harder.patch
new file mode 100644
index 0000000000..edfb693742
--- /dev/null
+++ b/target/linux/generic/hack-4.14/950-fix-crash-nf_xfrm_me_harder.patch
@@ -0,0 +1,11 @@
+--- a/net/netfilter/nf_nat_core.c
++++ b/net/netfilter/nf_nat_core.c
+@@ -98,6 +98,8 @@ int nf_xfrm_me_harder(struct net *net, s
+ 		return err;
+ 
+ 	dst = skb_dst(skb);
++	if (!dst)
++		return -EHOSTUNREACH;
+ 	if (dst->xfrm)
+ 		dst = ((struct xfrm_dst *)dst)->route;
+ 	if (!dst_hold_safe(dst))
diff --git a/target/linux/generic/hack-4.19/950-fix-crash-nf_xfrm_me_harder.patch b/target/linux/generic/hack-4.19/950-fix-crash-nf_xfrm_me_harder.patch
new file mode 100644
index 0000000000..11c41eb2a4
--- /dev/null
+++ b/target/linux/generic/hack-4.19/950-fix-crash-nf_xfrm_me_harder.patch
@@ -0,0 +1,11 @@
+--- a/net/netfilter/nf_nat_core.c
++++ b/net/netfilter/nf_nat_core.c
+@@ -118,6 +118,8 @@ int nf_xfrm_me_harder(struct net *net, s
+ 		return err;
+ 
+ 	dst = skb_dst(skb);
++	if (!dst)
++		return -EHOSTUNREACH;
+ 	if (dst->xfrm)
+ 		dst = ((struct xfrm_dst *)dst)->route;
+ 	if (!dst_hold_safe(dst))
diff --git a/target/linux/generic/pending-4.14/616-net_optimize_xfrm_calls.patch b/target/linux/generic/pending-4.14/616-net_optimize_xfrm_calls.patch
index c64694ea3c..79b3ad605a 100644
--- a/target/linux/generic/pending-4.14/616-net_optimize_xfrm_calls.patch
+++ b/target/linux/generic/pending-4.14/616-net_optimize_xfrm_calls.patch
@@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	struct dst_entry *dst;
  	int err;
  
-+	if (skb->dev && !dev_net(skb->dev)->xfrm.policy_count[XFRM_POLICY_OUT])
++	if (!net->xfrm.policy_count[XFRM_POLICY_OUT])
 +		return 0;
 +
  	err = xfrm_decode_session(skb, &fl, family);
diff --git a/target/linux/generic/pending-4.19/616-net_optimize_xfrm_calls.patch b/target/linux/generic/pending-4.19/616-net_optimize_xfrm_calls.patch
index 6a5801027c..3b2fed614e 100644
--- a/target/linux/generic/pending-4.19/616-net_optimize_xfrm_calls.patch
+++ b/target/linux/generic/pending-4.19/616-net_optimize_xfrm_calls.patch
@@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	struct sock *sk = skb->sk;
  	int err;
  
-+	if (skb->dev && !dev_net(skb->dev)->xfrm.policy_count[XFRM_POLICY_OUT])
++	if (!net->xfrm.policy_count[XFRM_POLICY_OUT])
 +		return 0;
 +
  	err = xfrm_decode_session(skb, &fl, family);