diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index af056c7df9..db1fd59ccf 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -556,7 +556,7 @@ static int usb_mtp_inotify_init(MTPState *s)
 
 static void usb_mtp_inotify_cleanup(MTPState *s)
 {
-    MTPMonEntry *e;
+    MTPMonEntry *e, *p;
 
     if (!s->inotifyfd) {
         return;
@@ -565,7 +565,7 @@ static void usb_mtp_inotify_cleanup(MTPState *s)
     qemu_set_fd_handler(s->inotifyfd, NULL, NULL, s);
     close(s->inotifyfd);
 
-    QTAILQ_FOREACH(e, &s->events, next) {
+    QTAILQ_FOREACH_SAFE(e, &s->events, next, p) {
         QTAILQ_REMOVE(&s->events, e, next);
         g_free(e);
     }