diff --git a/CHANGES b/CHANGES
index c08745e8e5..8d0760ac51 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4151.	[bug]		'rndc flush' could cause a deadlock. [RT #39835]
+
 4150.	[bug]		win32: listen-on-v6 { any; }; was not working.  Apply
 			minimal fix.  [RT #39667]
 
diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index 109f06da3e..f2e50bbdc1 100644
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -1141,31 +1141,43 @@ cleaner_shutdown_action(isc_task_t *task, isc_event_t *event) {
 
 isc_result_t
 dns_cache_flush(dns_cache_t *cache) {
-	dns_db_t *db = NULL;
+	dns_db_t *db = NULL, *olddb;
+	dns_dbiterator_t *dbiterator = NULL, *olddbiterator = NULL;
 	isc_result_t result;
 
 	result = cache_create_db(cache, &db);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
+	result = dns_db_createiterator(db, ISC_FALSE, &dbiterator);
+	if (result != ISC_R_SUCCESS) {
+		dns_db_detach(&db);
+		return (result);
+	}
+
 	LOCK(&cache->lock);
 	LOCK(&cache->cleaner.lock);
 	if (cache->cleaner.state == cleaner_s_idle) {
-		if (cache->cleaner.iterator != NULL)
-			dns_dbiterator_destroy(&cache->cleaner.iterator);
-		(void) dns_db_createiterator(db, ISC_FALSE,
-					     &cache->cleaner.iterator);
+		olddbiterator = cache->cleaner.iterator;
+		cache->cleaner.iterator = dbiterator;
+		dbiterator = NULL;
 	} else {
 		if (cache->cleaner.state == cleaner_s_busy)
 			cache->cleaner.state = cleaner_s_done;
 		cache->cleaner.replaceiterator = ISC_TRUE;
 	}
-	dns_db_detach(&cache->db);
+	olddb = cache->db;
 	cache->db = db;
 	dns_db_setcachestats(cache->db, cache->stats);
 	UNLOCK(&cache->cleaner.lock);
 	UNLOCK(&cache->lock);
 
+	if (dbiterator != NULL)
+		dns_dbiterator_destroy(&dbiterator);
+	if (olddbiterator != NULL)
+		dns_dbiterator_destroy(&olddbiterator);
+	dns_db_detach(&olddb);
+
 	return (ISC_R_SUCCESS);
 }