diff --git a/CHANGES b/CHANGES
index 6641588884..6414c3fcc3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,8 @@
 
+2.6-beta2-25 | 2018-10-12 08:33:32 -0400
+
+  * Fix crash when modifying a table from within its &expire_func (Jon Siwek, Corelight)
+
 2.6-beta2-24 | 2018-10-05 14:24:34 -0500
 
   * GH-184: add `bro-config --build_type`, outputs CMake build type (Jon Siwek, Corelight)
diff --git a/VERSION b/VERSION
index ffa82dd240..2d4d80fba8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.6-beta2-24
+2.6-beta2-25
diff --git a/src/Val.cc b/src/Val.cc
index 71d38e3c63..144eb995ee 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -2361,8 +2361,6 @@ void TableVal::DoExpire(double t)
 
 		else if ( v->ExpireAccessTime() + timeout < t )
 			{
-			Val* val = v->Value();
-
 			if ( expire_func )
 				{
 				Val* idx = RecoverIndex(k);
@@ -2403,8 +2401,8 @@ void TableVal::DoExpire(double t)
 					new StateAccess(OP_EXPIRE, this, k));
 
 			tbl->RemoveEntry(k);
+			Unref(v->Value());
 			delete v;
-			Unref(val);
 			Modified();
 			}
 
diff --git a/testing/btest/Baseline/language.expire_func_mod/out b/testing/btest/Baseline/language.expire_func_mod/out
new file mode 100644
index 0000000000..8790608ec1
--- /dev/null
+++ b/testing/btest/Baseline/language.expire_func_mod/out
@@ -0,0 +1,10 @@
+starting: ashish, 1
+inside table_expire_func: ashish, 2
+inside table_expire_func: ashish, 3
+inside table_expire_func: ashish, 4
+inside table_expire_func: ashish, 5
+inside table_expire_func: ashish, 6
+inside table_expire_func: ashish, 7
+inside table_expire_func: ashish, 8
+inside table_expire_func: ashish, 9
+inside table_expire_func: ashish, 10
diff --git a/testing/btest/language/expire_func_mod.bro b/testing/btest/language/expire_func_mod.bro
new file mode 100644
index 0000000000..4790a9650e
--- /dev/null
+++ b/testing/btest/language/expire_func_mod.bro
@@ -0,0 +1,41 @@
+# @TEST-EXEC: bro -b %INPUT >out
+# @TEST-EXEC: btest-diff out
+
+module Test;
+
+redef exit_only_after_terminate = T;
+redef table_expire_interval = .1 secs ;
+
+export {
+	global table_expire_func: function(t: table[string] of count,
+	                                   s: string): interval;
+
+	global t: table[string] of count
+		&write_expire=0 secs
+		&expire_func=table_expire_func;
+}
+
+event die()
+	{
+	terminate();
+	}
+
+function table_expire_func(t: table[string] of count, s: string): interval
+	{
+	t[s] += 1 ;
+
+	print fmt("inside table_expire_func: %s, %s", s, t[s]);
+
+	if ( t[s] < 10 )
+		return .1 secs ;
+
+	schedule .1sec { die() };
+	return 0 secs;
+	}
+
+event bro_init()
+	{
+	local s="ashish";
+	t[s] = 1 ;
+	print fmt("starting: %s, %s", s, t[s]);
+	}