diff --git a/sys/kern/kern_caps.c b/sys/kern/kern_caps.c
--- a/sys/kern/kern_caps.c
+++ b/sys/kern/kern_caps.c
@@ -165,16 +165,18 @@
 		pp = pfind(curproc->p_ppid);
 		if (pp == NULL)
 			return EINVAL;
+		lwkt_gettoken(&pp->p_token);	/* protect p_ucred */
 		if (pp->p_ucred->cr_uid != curproc->p_ucred->cr_uid ||
 		    pp->p_ucred->cr_prison != curproc->p_ucred->cr_prison)
 		{
+			lwkt_reltoken(&pp->p_token);
 			PRELE(pp);		/* from pfind */
 			return EINVAL;
 		}
 	} else {
 		pp = curproc;
-	}
-	lwkt_gettoken(&pp->p_token);		/* protect p_ucred */
+		lwkt_gettoken(&pp->p_token);	/* protect p_ucred */
+	}
 	cred = pp->p_ucred;
 
 	/*