diff --git a/libwvdrmengine/cdm/core/include/cdm_engine.h b/libwvdrmengine/cdm/core/include/cdm_engine.h
index 50ad2246..a3c8e767 100644
--- a/libwvdrmengine/cdm/core/include/cdm_engine.h
+++ b/libwvdrmengine/cdm/core/include/cdm_engine.h
@@ -452,7 +452,10 @@ class CdmEngine {
   // API will release the handle to previously active secure stop license.
   std::unique_ptr<CdmSession> usage_session_;
   std::unique_ptr<UsagePropertySet> usage_property_set_;
-  int64_t last_usage_information_update_time_;
+  int64_t last_usage_information_update_time_ = 0;
+  // Should be acquired before changes to |usage_property_set_| or
+  // |usage_session_|.
+  std::mutex usage_session_mutex_;
 
   // Protect release_key_sets_ from non-thread-safe operations.
   std::mutex release_key_sets_lock_;
diff --git a/libwvdrmengine/cdm/core/src/cdm_engine.cpp b/libwvdrmengine/cdm/core/src/cdm_engine.cpp
index 1b554180..2f47e3ec 100644
--- a/libwvdrmengine/cdm/core/src/cdm_engine.cpp
+++ b/libwvdrmengine/cdm/core/src/cdm_engine.cpp
@@ -95,18 +95,17 @@ class UsagePropertySet : public CdmClientPropertySet {
 
 CdmEngine::CdmEngine(wvutil::FileSystem* file_system,
                      std::shared_ptr<metrics::EngineMetrics> metrics)
-    : metrics_(metrics),
-      file_system_(file_system),
-      spoid_(EMPTY_SPOID),
-      usage_session_(),
-      usage_property_set_(),
-      last_usage_information_update_time_(0) {
+    : metrics_(metrics), file_system_(file_system), spoid_(EMPTY_SPOID) {
   assert(file_system);
   Properties::Init();
 }
 
 CdmEngine::~CdmEngine() {
-  usage_session_.reset();
+  {
+    std::unique_lock<std::mutex> lock(usage_session_mutex_);
+    usage_session_.reset();
+  }
+
   std::unique_lock<std::recursive_mutex> lock(session_map_lock_);
   session_map_.Terminate();
 }
@@ -1520,6 +1519,7 @@ CdmResponseType CdmEngine::GetUsageInfo(const std::string& app_id,
                                         int* error_detail,
                                         CdmUsageReport* usage_report) {
   LOGI("app_id = %s, ssid = %s", IdToString(app_id), IdToString(ssid));
+  std::unique_lock<std::mutex> lock(usage_session_mutex_);
   if (!usage_property_set_) {
     usage_property_set_.reset(new UsagePropertySet());
   }
@@ -1629,6 +1629,7 @@ CdmResponseType CdmEngine::GetUsageInfo(
     LOGD("OKP fallback to L3");
     requested_security_level = kLevel3;
   }
+  std::unique_lock<std::mutex> lock(usage_session_mutex_);
   if (!usage_property_set_) {
     usage_property_set_.reset(new UsagePropertySet());
   }
@@ -1691,6 +1692,7 @@ CdmResponseType CdmEngine::RemoveAllUsageInfo(
     const std::string& app_id, CdmSecurityLevel cdm_security_level) {
   LOGI("app_id = %s, security_level = %s", IdToString(app_id),
        CdmSecurityLevelToString(cdm_security_level));
+  std::unique_lock<std::mutex> lock(usage_session_mutex_);
   if (!usage_property_set_) {
     usage_property_set_.reset(new UsagePropertySet());
   }
@@ -1764,6 +1766,7 @@ CdmResponseType CdmEngine::RemoveUsageInfo(
     const std::string& app_id, const CdmSecureStopId& provider_session_token) {
   LOGI("app_id = %s, pst = %s", IdToString(app_id),
        IdToString(provider_session_token));
+  std::unique_lock<std::mutex> lock(usage_session_mutex_);
   if (!usage_property_set_) {
     usage_property_set_.reset(new UsagePropertySet());
   }
@@ -1808,6 +1811,7 @@ CdmResponseType CdmEngine::RemoveUsageInfo(
 
 CdmResponseType CdmEngine::ReleaseUsageInfo(const CdmKeyResponse& message) {
   LOGI("message_size = %zu", message.size());
+  std::unique_lock<std::mutex> lock(usage_session_mutex_);
   if (!usage_session_) {
     LOGE("Usage session not initialized");
     return CdmResponseType(RELEASE_USAGE_INFO_ERROR);