diff --git a/net/devif/devif_poll.c b/net/devif/devif_poll.c
index 0f4a09b1660..495a941c9d7 100644
--- a/net/devif/devif_poll.c
+++ b/net/devif/devif_poll.c
@@ -647,6 +647,7 @@ static inline int devif_poll_tcp_connections(FAR struct net_driver_s *dev,
 
   /* Traverse all of the active TCP connections and perform the poll action */
 
+  tcp_conn_list_lock();
   while (!bstop && (conn = tcp_nextconn(conn)))
     {
       /* Skip TCP connections that are bound to other polling devices */
@@ -667,6 +668,7 @@ static inline int devif_poll_tcp_connections(FAR struct net_driver_s *dev,
         }
     }
 
+  tcp_conn_list_unlock();
   return bstop;
 }
 #else
diff --git a/net/tcp/tcp_conn.c b/net/tcp/tcp_conn.c
index 6890d6128e4..d97b1ae8561 100644
--- a/net/tcp/tcp_conn.c
+++ b/net/tcp/tcp_conn.c
@@ -786,10 +786,6 @@ void tcp_free(FAR struct tcp_conn_s *conn)
       return;
     }
 
-  /* Cancel tcp timer */
-
-  tcp_stop_timer(conn);
-
   /* Make sure monitor is stopped. */
 
   conn_dev_lock(&conn->sconn, conn->dev);
@@ -820,6 +816,10 @@ void tcp_free(FAR struct tcp_conn_s *conn)
       tcp_conn_list_unlock();
     }
 
+  /* Cancel tcp timer */
+
+  tcp_stop_timer(conn);
+
   nxrmutex_destroy(&conn->sconn.s_lock);
   tcp_free_rx_buffers(conn);