Index: kernel/generic/src/ipc/ops/conctmeto.c
===================================================================
--- kernel/generic/src/ipc/ops/conctmeto.c	(revision a35b458e9db1ca95e679799dc7c1b12c83359ca3)
+++ kernel/generic/src/ipc/ops/conctmeto.c	(revision c377c5e474885d33e24101d261afc20e99e62460)
@@ -52,7 +52,15 @@
 	}
 
-	/* Set arg5 for server */
+	/* Set ARG5 for server */
 	kobject_t *phone_obj = kobject_get(TASK, phone_handle,
 	    KOBJECT_TYPE_PHONE);
+	if (!phone_obj) {
+		/*
+		 * Another thread of the same task can destroy the new
+		 * capability before we manage to get a reference from it.
+		 */
+		call->priv = -1;
+		return ENOENT;
+	}
 	/* Hand over phone_obj's reference to ARG5 */
 	IPC_SET_ARG5(call->data, (sysarg_t) phone_obj->phone);