diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 58bb878..c15e533 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -45,6 +45,7 @@
 	}
 
 	/* set the new root user in the credentials under preparation */
+	ns->parent = parent_ns;
 	ns->creator = new->user;
 	new->user = root_user;
 	new->uid = new->euid = new->suid = new->fsuid = 0;
@@ -60,8 +61,6 @@
 	/* Leave the reference to our user_ns with the new cred */
 	new->user_ns = ns;
 
-	put_user_ns(parent_ns);
-
 	return 0;
 }
 
@@ -72,10 +71,12 @@
  */
 static void free_user_ns_work(struct work_struct *work)
 {
-	struct user_namespace *ns =
+	struct user_namespace *parent, *ns =
 		container_of(work, struct user_namespace, destroyer);
+	parent = ns->parent;
 	free_uid(ns->creator);
 	kmem_cache_free(user_ns_cachep, ns);
+	put_user_ns(parent);
 }
 
 void free_user_ns(struct kref *kref)
@@ -99,8 +100,7 @@
 	/* Is cred->user the creator of the target user_ns
 	 * or the creator of one of it's parents?
 	 */
-	for ( tmp = to; tmp != &init_user_ns;
-	      tmp = tmp->creator->user_ns ) {
+	for ( tmp = to; tmp != &init_user_ns; tmp = tmp->parent ) {
 		if (cred->user == tmp->creator) {
 			return (uid_t)0;
 		}
@@ -120,8 +120,7 @@
 	/* Is cred->user the creator of the target user_ns
 	 * or the creator of one of it's parents?
 	 */
-	for ( tmp = to; tmp != &init_user_ns;
-	      tmp = tmp->creator->user_ns ) {
+	for ( tmp = to; tmp != &init_user_ns; tmp = tmp->parent ) {
 		if (cred->user == tmp->creator) {
 			return (gid_t)0;
 		}