diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 2e72ec0a2de2..ac4e0f2c3978 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -171,7 +171,7 @@ struct net {
 	struct netns_xfrm	xfrm;
 #endif
 
-	u64			net_cookie; /* written once */
+	atomic64_t		net_cookie; /* written once */
 
 #if IS_ENABLED(CONFIG_IP_VS)
 	struct netns_ipvs	*ipvs;
diff --git a/net/core/filter.c b/net/core/filter.c
index e22104ab7869..01b8a18e8bb1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4694,7 +4694,7 @@ static u64 __bpf_get_netns_cookie(struct sock *sk)
 {
 	const struct net *net = sk ? sock_net(sk) : &init_net;
 
-	return net->net_cookie;
+	return atomic64_read(&net->net_cookie);
 }
 
 BPF_CALL_1(bpf_get_netns_cookie_sock, struct sock *, ctx)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 9897641de690..1f7e48138860 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -342,7 +342,7 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
 	refcount_set(&net->passive, 1);
 	get_random_bytes(&net->hash_mix, sizeof(u32));
 	preempt_disable();
-	net->net_cookie = gen_cookie_next(&net_cookie);
+	atomic64_set(&net->net_cookie, gen_cookie_next(&net_cookie));
 	preempt_enable();
 	net->dev_base_seq = 1;
 	net->user_ns = user_ns;