diff --git a/server/RouteController.cpp b/server/RouteController.cpp
index e2f317d..498ac11 100644
--- a/server/RouteController.cpp
+++ b/server/RouteController.cpp
@@ -136,7 +136,8 @@
     }
 }
 
-uint32_t RouteController::getRouteTableForInterface(const char* interface) {
+// Caller must hold sInterfaceToTableLock.
+uint32_t RouteController::getRouteTableForInterfaceLocked(const char* interface) {
     uint32_t index = if_nametoindex(interface);
     if (index) {
         index += RouteController::ROUTE_TABLE_OFFSET_FROM_INDEX;
@@ -153,6 +154,11 @@
     return iter->second;
 }
 
+uint32_t RouteController::getRouteTableForInterface(const char* interface) {
+    android::RWLock::AutoRLock lock(sInterfaceToTableLock);
+    return getRouteTableForInterfaceLocked(interface);
+}
+
 void addTableName(uint32_t table, const std::string& name, std::string* contents) {
     char tableString[UINT32_STRLEN];
     snprintf(tableString, sizeof(tableString), "%u", table);
@@ -173,6 +179,7 @@
     addTableName(ROUTE_TABLE_LEGACY_NETWORK, ROUTE_TABLE_NAME_LEGACY_NETWORK, &contents);
     addTableName(ROUTE_TABLE_LEGACY_SYSTEM,  ROUTE_TABLE_NAME_LEGACY_SYSTEM,  &contents);
 
+    android::RWLock::AutoRLock lock(sInterfaceToTableLock);
     for (const auto& entry : sInterfaceToTable) {
         addTableName(entry.second, entry.first, &contents);
     }
@@ -905,7 +912,9 @@
 
 // Returns 0 on success or negative errno on failure.
 WARN_UNUSED_RESULT int RouteController::flushRoutes(const char* interface) {
-    uint32_t table = getRouteTableForInterface(interface);
+    android::RWLock::AutoWLock lock(sInterfaceToTableLock);
+
+    uint32_t table = getRouteTableForInterfaceLocked(interface);
     if (table == RT_TABLE_UNSPEC) {
         return -ESRCH;
     }
@@ -1064,7 +1073,9 @@
     return modifyVpnFallthroughRule(RTM_DELRULE, vpnNetId, physicalInterface, permission);
 }
 
-// No locks needed because RouteController is accessed only from one thread (in CommandListener).
+// Protects sInterfaceToTable.
+android::RWLock RouteController::sInterfaceToTableLock;
+
 std::map<std::string, uint32_t> RouteController::sInterfaceToTable;
 
 }  // namespace net
diff --git a/server/RouteController.h b/server/RouteController.h
index b01e283..de79b61 100644
--- a/server/RouteController.h
+++ b/server/RouteController.h
@@ -102,11 +102,14 @@
 private:
     friend class RouteControllerTest;
 
+    // Protects access to interfaceToTable.
+    static android::RWLock sInterfaceToTableLock;
     static std::map<std::string, uint32_t> sInterfaceToTable;
 
     static int configureDummyNetwork();
     static int flushRoutes(const char* interface);
     static int flushRoutes(uint32_t table);
+    static uint32_t getRouteTableForInterfaceLocked(const char *interface);
     static uint32_t getRouteTableForInterface(const char *interface);
     static int modifyDefaultNetwork(uint16_t action, const char* interface, Permission permission);
     static int modifyPhysicalNetwork(unsigned netId, const char* interface, Permission permission,