diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 2bd1f3bf62ee9e36ca9b49a2abe8d41367aac180..70271617e2a3ad493a6f44739d5de896107b5a8e 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1307,6 +1307,10 @@ static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
 		if (fnhe->fnhe_daddr == daddr) {
 			rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
 				fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
+			/* set fnhe_daddr to 0 to ensure it won't bind with
+			 * new dsts in rt_bind_exception().
+			 */
+			fnhe->fnhe_daddr = 0;
 			fnhe_flush_routes(fnhe);
 			kfree_rcu(fnhe, rcu);
 			break;