diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 08ddf9d837ae..76bc90516b11 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -305,10 +305,14 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
 	long timeo = sock_sndtimeo(sk, 0);
 	bool free_ctx;
 
-	if (ctx->tx_conf == TLS_SW)
+	lock_sock(sk);
+	sk->sk_shutdown = SHUTDOWN_MASK;
+	if (ctx->tx_conf == TLS_SW) {
+		release_sock(sk);
 		tls_sw_cancel_work_tx(ctx);
+		lock_sock(sk);
+	}
 
-	lock_sock(sk);
 	free_ctx = ctx->tx_conf != TLS_HW && ctx->rx_conf != TLS_HW;
 
 	if (ctx->tx_conf != TLS_BASE || ctx->rx_conf != TLS_BASE)