diff --git a/dp/wifi3.0/dp_rx_buffer_pool.c b/dp/wifi3.0/dp_rx_buffer_pool.c
index 3ba6a84ae2..2afcf2a97e 100644
--- a/dp/wifi3.0/dp_rx_buffer_pool.c
+++ b/dp/wifi3.0/dp_rx_buffer_pool.c
@@ -174,6 +174,13 @@ void dp_rx_refill_buff_pool_enqueue(struct dp_soc *soc)
 			count++;
 		}
 
+		/* All operations above have to be completed before
+		 * assigning the head pointer to buff_pool->head.
+		 * Otherwise, we will end up using a stale NBUF in
+		 * the RX replenish path.
+		 */
+		qdf_wmb();
+
 		if (count) {
 			buff_pool->head = head;
 			total_num_refill -= count;