diff --git a/sys/kern/kern_acl.c b/sys/kern/kern_acl.c
--- a/sys/kern/kern_acl.c
+++ b/sys/kern/kern_acl.c
@@ -94,7 +94,9 @@
 	int error;
 
 	ucred = td->td_ucred;
+	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
 	error = VOP_GETACL(vp, type, &inkernelacl, ucred);
+	vn_unlock(vp);
 	if (error == 0)
 		error = copyout(&inkernelacl, aclp, sizeof(struct acl));
 	return (error);