diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index b7e25e7e9933b69aa6a3364e3287c358b7ac9421..1d359de9dd6ad7ff60b6b93f620ff6783e385106 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -807,6 +807,7 @@ static void cleanup_bearer(struct work_struct *work)
 {
        struct udp_bearer *ub = container_of(work, struct udp_bearer, work);
        struct udp_replicast *rcast, *tmp;
+       struct tipc_net *tn;
 
        list_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) {
                dst_cache_destroy(&rcast->dst_cache);
@@ -814,10 +815,14 @@ static void cleanup_bearer(struct work_struct *work)
                kfree_rcu(rcast, rcu);
        }
 
+       tn = tipc_net(sock_net(ub->ubsock->sk));
+
        dst_cache_destroy(&ub->rcast.dst_cache);
        udp_tunnel_sock_release(ub->ubsock);
+
+       /* Note: could use a call_rcu() to avoid a synchronize_net() */
        synchronize_net();
-       atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);
+       atomic_dec(&tn->wq_count);
        kfree(ub);
 }