diff --git a/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp b/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
index 0d81bbfec83..6759dd96761 100644
--- a/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
+++ b/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
@@ -3525,9 +3525,14 @@ class RegisterHumongousWithInCSetFastTestClosure : public HeapRegionClosure {
         size_t card_index;
         while (hrrs.has_next(card_index)) {
           jbyte* card_ptr = (jbyte*)bs->byte_for_index(card_index);
-          if (*card_ptr != CardTableModRefBS::dirty_card_val()) {
-            *card_ptr = CardTableModRefBS::dirty_card_val();
-            _dcq.enqueue(card_ptr);
+          // The remembered set might contain references to already freed
+          // regions. Filter out such entries to avoid failing card table
+          // verification.
+          if (!g1h->heap_region_containing(bs->addr_for(card_ptr))->is_free()) {
+            if (*card_ptr != CardTableModRefBS::dirty_card_val()) {
+              *card_ptr = CardTableModRefBS::dirty_card_val();
+              _dcq.enqueue(card_ptr);
+            }
           }
         }
         r->rem_set()->clear_locked();