diff --git a/src/system/kernel/fs/vfs.cpp b/src/system/kernel/fs/vfs.cpp
index 2971e9f400..02bc3bd359 100644
--- a/src/system/kernel/fs/vfs.cpp
+++ b/src/system/kernel/fs/vfs.cpp
@@ -3085,11 +3085,12 @@ vfs_get_vnode_cache(void *_vnode, vm_cache_ref **_cache, bool allocate)
 			vnode->busy = wasBusy;
 		} else
 			status = B_BAD_VALUE;
-	} else
-		vm_cache_acquire_ref(vnode->cache);
+	}
 
-	if (status == B_OK)
+	if (status == B_OK) {
+		vm_cache_acquire_ref(vnode->cache);
 		*_cache = vnode->cache;
+	}
 
 	mutex_unlock(&sVnodeMutex);
 	return status;
diff --git a/src/system/kernel/vm/vm.cpp b/src/system/kernel/vm/vm.cpp
index 9fbe433fe5..5b0333b525 100644
--- a/src/system/kernel/vm/vm.cpp
+++ b/src/system/kernel/vm/vm.cpp
@@ -1179,14 +1179,17 @@ _vm_map_file(team_id aid, const char *name, void **_address, uint32 addressSpec,
 
 	status = map_backing_store(addressSpace, cacheRef->cache->store, _address,
 		offset, size, addressSpec, 0, protection, mapping, &area, name);
+
+	if (status < B_OK || mapping == REGION_PRIVATE_MAP) {
+		// map_backing_store() cannot know we no longer need the ref
+		vm_cache_release_ref(cacheRef);
+	}
 	if (status < B_OK)
-		goto err2;
+		goto err1;
 
 	vm_put_address_space(addressSpace);
 	return area->id;
 
-err2:
-	vm_cache_release_ref(cacheRef);
 err1:
 	vm_put_address_space(addressSpace);
 	return status;