diff --git a/pkg/sentry/kernel/task.go b/pkg/sentry/kernel/task.go
index 9fb943fd1..93284958f 100644
--- a/pkg/sentry/kernel/task.go
+++ b/pkg/sentry/kernel/task.go
@@ -795,8 +795,11 @@ func (t *Task) MountNamespace() *vfs.MountNamespace {
 func (t *Task) GetMountNamespace() *vfs.MountNamespace {
 	t.mu.Lock()
 	defer t.mu.Unlock()
-	t.mountNamespace.IncRef()
-	return t.mountNamespace
+	mntns := t.mountNamespace
+	if mntns != nil {
+		mntns.IncRef()
+	}
+	return mntns
 }
 
 // AbstractSockets returns t's AbstractSocketNamespace.
diff --git a/pkg/sentry/kernel/task_exit.go b/pkg/sentry/kernel/task_exit.go
index 99dd4362f..43561a164 100644
--- a/pkg/sentry/kernel/task_exit.go
+++ b/pkg/sentry/kernel/task_exit.go
@@ -288,12 +288,11 @@ func (*runExitMain) execute(t *Task) taskRunState {
 	mntns := t.mountNamespace
 	t.mountNamespace = nil
 	ipcns := t.ipcns
+	t.ipcns = nil
 	netns := t.netns
 	t.netns = nil
 	t.mu.Unlock()
-	if mntns != nil {
-		mntns.DecRef(t)
-	}
+	mntns.DecRef(t)
 	ipcns.DecRef(t)
 	netns.DecRef(t)