diff --git a/pkg/sentry/vfs/mount.go b/pkg/sentry/vfs/mount.go
index 5ac49ca6b..633e8388a 100644
--- a/pkg/sentry/vfs/mount.go
+++ b/pkg/sentry/vfs/mount.go
@@ -954,11 +954,12 @@ retry:
 	// The current root and the new root must be in the context's mount namespace.
 	ns := MountNamespaceFromContext(ctx)
 	defer ns.DecRef(ctx)
+	vfs.mountMu.Lock()
 	if rootVd.mount.ns != ns || newRootVd.mount.ns != ns {
+		vfs.mountMu.Unlock()
 		return linuxerr.EINVAL
 	}
 
-	vfs.mountMu.Lock()
 	// Either the mount point at new_root, or the parent mount of that mount
 	// point, has propagation type MS_SHARED.
 	if newRootParent := newRootVd.mount.parent(); newRootVd.mount.propType == Shared || newRootParent.propType == Shared {