diff --git a/pkg/sentry/fsimpl/cgroupfs/cpuset.go b/pkg/sentry/fsimpl/cgroupfs/cpuset.go
index 8307d15a8..9f938306c 100644
--- a/pkg/sentry/fsimpl/cgroupfs/cpuset.go
+++ b/pkg/sentry/fsimpl/cgroupfs/cpuset.go
@@ -65,6 +65,8 @@ func newCPUSetController(k *kernel.Kernel, fs *filesystem) *cpusetController {
 
 // Clone implements controller.Clone.
 func (c *cpusetController) Clone() controller {
+	c.mu.Lock()
+	defer c.mu.Unlock()
 	cpus := c.cpus.Clone()
 	mems := c.mems.Clone()
 	new := &cpusetController{