diff --git a/NEWS b/NEWS
index 4ba1ecdd2..6d8d2f712 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,9 @@ Any uppercase BUG_* names are modernish shell bug IDs.
 - shcomp (the shell bytecode compiler) was fixed to correctly compile process
   substitutions used as the file name to a redirection, as in 'cmd < <(cmd)'.
 
+- Fixed a bug introduced on 2020-07-13 that set LINENO to the wrong line
+  number after leaving a virtual subshell in which LINENO had been unset.
+
 2021-04-21:
 
 - Fixed a bug introduced on 2020-09-28 that caused an interactive ksh to exit
diff --git a/src/cmd/ksh93/sh/subshell.c b/src/cmd/ksh93/sh/subshell.c
index 2d555316c..a245523aa 100644
--- a/src/cmd/ksh93/sh/subshell.c
+++ b/src/cmd/ksh93/sh/subshell.c
@@ -381,8 +381,9 @@ static void nv_restore(struct subshell *sp)
 		nv_setsize(mp,nv_size(np));
 		if(!(flags&NV_MINIMAL))
 			mp->nvenv = np->nvenv;
-		if(!nofree)
-			mp->nvfun = np->nvfun;
+		mp->nvfun = np->nvfun;
+		if(np->nvfun && nofree)
+			np->nvfun->nofree = nofree;
 		if(nv_isattr(np,NV_IDENT))
 		{
 			nv_offattr(np,NV_IDENT);
diff --git a/src/cmd/ksh93/tests/variables.sh b/src/cmd/ksh93/tests/variables.sh
index 2797b97fb..c0079382e 100755
--- a/src/cmd/ksh93/tests/variables.sh
+++ b/src/cmd/ksh93/tests/variables.sh
@@ -720,7 +720,6 @@ set --
 
 unset r v x
 (
-	ulimit -t unlimited 2>/dev/null  # TODO: this test messes up LINENO past the subshell unless we fork it
 	x=foo
 	for v in EDITOR VISUAL OPTIND CDPATH FPATH PATH ENV RANDOM SECONDS _ LINENO
 	do	nameref r=$v
@@ -1272,5 +1271,18 @@ if	((nsec<osec || nsec>osec+0.1))
 then	err_exit "SECONDS corrupted after leaving virtual subshell (expected $osec, got $nsec)"
 fi
 
+# Corruption of LINENO on leaving virtual subshell
+lineno_subshell=$tmp/lineno_subshell.sh
+cat >| "$lineno_subshell" << 'EOF'
+(
+	unset LINENO
+	:
+)
+echo $LINENO
+EOF
+exp=5
+got=$($SHELL "$lineno_subshell")
+[[ $exp == $got ]] || err_exit "LINENO corrupted after leaving virtual subshell (expected $exp, got $got)"
+
 # ======
 exit $((Errors<125?Errors:125))