diff --git a/pkg/sentry/vfs/mount.go b/pkg/sentry/vfs/mount.go
index caedbc579..291a7614c 100644
--- a/pkg/sentry/vfs/mount.go
+++ b/pkg/sentry/vfs/mount.go
@@ -1040,10 +1040,7 @@ retry:
 	if oldRoot.mount.root != oldRoot.dentry {
 		return newRoot, oldRoot, linuxerr.EINVAL
 	}
-	// The current root and the new root cannot be on the rootfs mount.
-	if oldRoot.mount.parent() == nil || newRoot.mount.parent() == nil {
-		return newRoot, oldRoot, linuxerr.EINVAL
-	}
+
 	// The current root and the new root must be in the context's mount namespace.
 	ns := MountNamespaceFromContext(ctx)
 	defer ns.DecRef(ctx)
@@ -1053,6 +1050,12 @@ retry:
 		return newRoot, oldRoot, linuxerr.EINVAL
 	}
 
+	// The current root and the new root cannot be on the rootfs mount.
+	if oldRoot.mount.parent() == nil || newRoot.mount.parent() == nil {
+		vfs.unlockMounts(ctx)
+		return newRoot, oldRoot, linuxerr.EINVAL
+	}
+
 	// Either the mount point at new_root, or the parent mount of that mount
 	// point, has propagation type MS_SHARED.
 	if newRootParent := newRoot.mount.parent(); newRoot.mount.isShared || newRootParent.isShared {