diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py
index b14dd208c..f32f80f8a 100644
--- a/volatility3/framework/plugins/linux/malware/process_spoofing.py
+++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py
@@ -61,7 +61,7 @@ class ProcessSpoofing(plugins.PluginInterface):
         try:
             mm = task.mm
             if not mm or not mm.is_readable():
-                # Kernel threads doesn't have mm
+                # Kernel threads don't have mm struct
                 return None
 
             exe_file = mm.exe_file
@@ -69,7 +69,7 @@ class ProcessSpoofing(plugins.PluginInterface):
             if not exe_file or not exe_file.is_readable():
                 return None
 
-            exe_inode = exe_file.dereference().f_path.dentry.d_inode
+            exe_inode = exe_file.f_path.dentry.d_inode
             exe_path = linux.LinuxUtilities.path_for_file(self.context, task, exe_file)
 
             # If the inode link count is 0, the process image has been deleted