diff --git a/components/nvs_flash/src/nvs_api.cpp b/components/nvs_flash/src/nvs_api.cpp
index ec8f4bd774e..068a85e371c 100644
--- a/components/nvs_flash/src/nvs_api.cpp
+++ b/components/nvs_flash/src/nvs_api.cpp
@@ -82,10 +82,11 @@ static esp_err_t close_handles_and_deinit(const char* part_name)
 
     auto it = find_if(begin(s_nvs_handles), end(s_nvs_handles), belongs_to_part);
 
-    // Same as nvs_close(): erase from the list and delete the entry (frees NVSHandleSimple).
+    // Same as nvs_close(): unlink first, then delete. Deleting while still linked
+    // UAF-corrupts the intrusive list (hangs host tests).
     while (it != end(s_nvs_handles)) {
-        delete static_cast<NVSHandleEntry*>(it);
         s_nvs_handles.erase(it);
+        delete static_cast<NVSHandleEntry*>(it);
         it = find_if(begin(s_nvs_handles), end(s_nvs_handles), belongs_to_part);
     }