diff --git a/lib/core-net/adopt.c b/lib/core-net/adopt.c
index 4e89fdc3b..11e84184d 100644
--- a/lib/core-net/adopt.c
+++ b/lib/core-net/adopt.c
@@ -186,8 +186,10 @@ lws_adopt_descriptor_vhost1(struct lws_vhost *vh, lws_adoption_type type,
 	 * join him to the vhost's list of these kinds of incomplete wsi until
 	 * he gets another identity (he may do async dns now...)
 	 */
+	lws_vhost_lock(new_wsi->a.vhost);
 	lws_dll2_add_head(&new_wsi->vh_awaiting_socket,
 			  &new_wsi->a.vhost->vh_awaiting_socket_owner);
+	lws_vhost_unlock(new_wsi->a.vhost);
 
 	return new_wsi;
 
@@ -377,8 +379,10 @@ lws_adopt_descriptor_vhost2(struct lws *new_wsi, lws_adoption_type type,
 		}
 #endif
 
+	lws_vhost_lock(new_wsi->a.vhost);
 	/* he has fds visibility now, remove from vhost orphan list */
 	lws_dll2_remove(&new_wsi->vh_awaiting_socket);
+	lws_vhost_unlock(new_wsi->a.vhost);
 
 	/*
 	 *  by deferring callback to this point, after insertion to fds,
diff --git a/lib/core-net/close.c b/lib/core-net/close.c
index 5a97657a1..e8f756788 100644
--- a/lib/core-net/close.c
+++ b/lib/core-net/close.c
@@ -71,8 +71,11 @@ __lws_reset_wsi(struct lws *wsi)
 	}
 #endif
 
-	if (wsi->a.vhost)
+	if (wsi->a.vhost) {
+		lws_vhost_lock(wsi->a.vhost);
 		lws_dll2_remove(&wsi->vh_awaiting_socket);
+		lws_vhost_unlock(wsi->a.vhost);
+	}
 
 	/*
 	 * Protocol user data may be allocated either internally by lws