diff --git a/sys/vfs/smbfs/smbfs_node.c b/sys/vfs/smbfs/smbfs_node.c
index 0000000..1111111 100644
--- a/sys/vfs/smbfs/smbfs_node.c
+++ b/sys/vfs/smbfs/smbfs_node.c
@@ -205,12 +205,16 @@
 			goto retry;
 		/*
 		 * relookup after we blocked.
+		 * Re-acquire the hash lock to prevent a concurrent smbfs_reclaim
+		 * from freeing a smbnode mid-traversal (UAF).
 		 */
+		smbfs_hash_lock(smp, td);
 		LIST_FOREACH(np2, nhpp, n_hash) {
 			if (np2->n_parent == dvp && np2->n_nmlen == nmlen &&
 			    bcmp(name, np2->n_name, nmlen) == 0)
 				break;
 		}
+		smbfs_hash_unlock(smp, td);
 		if (np2 != np || SMBTOV(np2) != vp) {
 			vput(vp);
 			goto retry;