--- x/net/netfilter/ipset/ip_set_bitmap_gen.h
+++ y/net/netfilter/ipset/ip_set_bitmap_gen.h
@@ -60,6 +60,7 @@ mtype_destroy(struct ip_set *set)
 {
 	struct mtype *map = set->data;
 
+	del_timer_sync(&map->gc);
 	if (set->dsize && set->extensions & IPSET_EXT_DESTROY)
 		mtype_ext_cleanup(set);
 	ip_set_free(map->members);