diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 007a9fda9a48..9764f4cc1d94 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -171,7 +171,7 @@ struct net {
 	struct netns_xfrm	xfrm;
 #endif
 
-	u64			net_cookie; /* written once */
+	atomic64_t		net_cookie; /* written once */
 
 #if IS_ENABLED(CONFIG_IP_VS)
 	struct netns_ipvs	*ipvs;
diff --git a/net/core/filter.c b/net/core/filter.c
index 16af230341ad..bca0002228cd 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4638,7 +4638,7 @@ static u64 __bpf_get_netns_cookie(struct sock *sk)
 {
 	const struct net *net = sk ? sock_net(sk) : &init_net;
 
-	return net->net_cookie;
+	return atomic64_read(&net->net_cookie);
 }
 
 BPF_CALL_1(bpf_get_netns_cookie_sock, struct sock *, ctx)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 20a0fc4d059b..f1258afa1475 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -330,7 +330,7 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
 	refcount_set(&net->passive, 1);
 	get_random_bytes(&net->hash_mix, sizeof(u32));
 	preempt_disable();
-	net->net_cookie = gen_cookie_next(&net_cookie);
+	atomic64_set(&net->net_cookie, gen_cookie_next(&net_cookie));
 	preempt_enable();
 	net->dev_base_seq = 1;
 	net->user_ns = user_ns;
diff --git a/net/core/sock.c b/net/core/sock.c
index fe7799499963..64e2f9fb6552 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1617,7 +1617,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
 		lv = sizeof(u64);
 		if (len != lv)
 			return -EINVAL;
-		v.val64 = sock_net(sk)->net_cookie;
+		v.val64 = atomic64_read(&sock_net(sk)->net_cookie);
 		break;
 
 	default: