diff --git a/daemon/media_socket.c b/daemon/media_socket.c
index 78d3ae515..a5faf1904 100644
--- a/daemon/media_socket.c
+++ b/daemon/media_socket.c
@@ -1929,6 +1929,10 @@ static void kernelize(struct packet_stream *stream) {
 	if (!stream->selected_sfd)
 		goto no_kernel;
 
+	{
+
+	LOCK(&stream->selected_sfd->lock);
+
 	if (stream->selected_sfd->kernelized)
 		return;
 
@@ -2005,6 +2009,8 @@ static void kernelize(struct packet_stream *stream) {
 	stream->kernel_time_us = rtpe_now;
 	stream->selected_sfd->kernelized = true;
 
+	}
+
 	return;
 
 no_kernel_warn:
@@ -3935,6 +3941,7 @@ static void stream_fd_free(stream_fd *f) {
 	release_port(&f->spl);
 	crypto_cleanup(&f->crypto);
 	dtls_connection_cleanup(&f->dtls);
+	mutex_destroy(&f->lock);
 
 	obj_put(f->call);
 }
@@ -3944,6 +3951,7 @@ stream_fd *stream_fd_new(struct socket_port_link *spl, call_t *call, struct loca
 	struct poller_item pi;
 
 	sfd = obj_alloc0(stream_fd, stream_fd_free);
+	mutex_init(&sfd->lock);
 	sfd->unique_id = t_queue_get_length(&call->stream_fds);
 	sfd->call = obj_get(call);
 	sfd->local_intf = lif;
diff --git a/include/media_socket.h b/include/media_socket.h
index c3d7ced8e..71c1cd4e5 100644
--- a/include/media_socket.h
+++ b/include/media_socket.h
@@ -221,6 +221,7 @@ struct stream_fd {
 	 * (plus some other wrapper functions).
 	 */
 	struct obj			obj;
+	mutex_t				lock; // for kernelized flag, nested under stream->lock
 
 	unsigned int			unique_id;	/* RO */
 	union {