diff --git a/ip/iplink_vxlan.c b/ip/iplink_vxlan.c
index 7ba68bc1..bff583a7 100644
--- a/ip/iplink_vxlan.c
+++ b/ip/iplink_vxlan.c
@@ -266,6 +266,11 @@ static int vxlan_parse_opt(struct link_util *lu, int argc, char **argv,
 		return -1;
 	}
 
+	if ((gaddr || !IN6_IS_ADDR_UNSPECIFIED(&gaddr6)) && !link) {
+		fprintf(stderr, "vxlan: 'group' requires 'dev' to be specified\n");
+		return -1;
+	}
+
 	if (!dst_port_set && gpe) {
 		dstport = 4790;
 	} else if (!dst_port_set) {
diff --git a/ip/ipmacsec.c b/ip/ipmacsec.c
index 2e670e9e..127fa1e3 100644
--- a/ip/ipmacsec.c
+++ b/ip/ipmacsec.c
@@ -152,9 +152,9 @@ static void get_icvlen(__u8 *icvlen, char *arg)
 	if (ret)
 		invarg("expected ICV length", arg);
 
-	if (*icvlen < MACSEC_MIN_ICV_LEN || *icvlen > MACSEC_MAX_ICV_LEN)
+	if (*icvlen < MACSEC_MIN_ICV_LEN || *icvlen > MACSEC_STD_ICV_LEN)
 		invarg("ICV length must be in the range {"
-		       STR(MACSEC_MIN_ICV_LEN) ".." STR(MACSEC_MAX_ICV_LEN)
+		       STR(MACSEC_MIN_ICV_LEN) ".." STR(MACSEC_STD_ICV_LEN)
 		       "}", arg);
 }
 
diff --git a/tc/tc_util.c b/tc/tc_util.c
index 15e49b7b..24ca1f1c 100644
--- a/tc/tc_util.c
+++ b/tc/tc_util.c
@@ -82,7 +82,7 @@ int get_qdisc_handle(__u32 *h, const char *str)
 	if (strcmp(str, "none") == 0)
 		goto ok;
 	maj = strtoul(str, &p, 16);
-	if (p == str)
+	if (p == str || maj >= (1 << 16))
 		return -1;
 	maj <<= 16;
 	if (*p != ':' && *p != 0)