diff --git a/hadolint.cabal b/hadolint.cabal
--- a/hadolint.cabal
+++ b/hadolint.cabal
@@ -2,10 +2,10 @@
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 2a386958e9870479c4f5a2e87fff7c8e8b1c44c1fba66de905c00842552fa9bd
+-- hash: 75261d1fd2666e4cf51cc373eff3f66cd088bb91c074dbc3224441446747b4eb
 
 name:           hadolint
-version:        1.10.3
+version:        1.10.4
 synopsis:       Dockerfile Linter JavaScript API
 description:    A smarter Dockerfile linter that helps you build best practice Docker images.
 category:       Development
diff --git a/src/Hadolint/Rules.hs b/src/Hadolint/Rules.hs
--- a/src/Hadolint/Rules.hs
+++ b/src/Hadolint/Rules.hs
@@ -4,12 +4,13 @@
 module Hadolint.Rules where
 
 import Control.Arrow ((&&&))
-import Data.List (dropWhile, isInfixOf, isPrefixOf, mapAccumL, nub)
+import Data.List
+       (dropWhile, foldl', isInfixOf, isPrefixOf, mapAccumL, nub)
 import Data.List.NonEmpty (toList)
-import Data.Maybe (catMaybes)
 import qualified Hadolint.Shell as Shell
 import Language.Docker.Syntax
 
+import qualified Data.Map as Map
 import Data.Semigroup (Semigroup, (<>))
 import qualified Data.Set as Set
 import qualified Data.Text as Text
@@ -354,25 +355,27 @@
     severity = WarningC
     message = "Last USER should not be root"
     check _ _ (From from) = withState (Just from) True -- Remember the last FROM instruction found
-    check st@(Just _) line (User user)
-        | isRoot user && lastUserIsRoot line = withState st False
+    check st@(Just from) line (User user)
+        | isRoot user && lastUserIsRoot from line = withState st False
         | otherwise = withState st True
     check st _ _ = withState st True
     --
     --
-    lastUserIsRoot line = (line, True) `elem` rootStages
+    lastUserIsRoot from line = Map.lookup from rootStages == Just line
     --
     --
-    rootStages :: [(Linenumber, Bool)]
+    rootStages :: Map.Map BaseImage Linenumber
     rootStages =
-        let (_, userTuples) =
-                mapAccumL buildMap Nothing (map (instruction &&& lineNumber) dockerfile)
-        in catMaybes userTuples
+        let indexedInstructions = map (instruction &&& lineNumber) dockerfile
+            (_, usersMap) = foldl' buildMap (Nothing, Map.empty) indexedInstructions
+        in usersMap
     --
     --
-    buildMap _ (From from, _) = withState (Just from) Nothing
-    buildMap st@(Just _) (User user, line) = withState st (Just (line, isRoot user))
-    buildMap st _ = withState st Nothing
+    buildMap (_, st) (From from, _) = (Just from, st) -- Remember the FROM we are currently inspecting
+    buildMap (Just from, st) (User user, line)
+        | isRoot user = (Just from, Map.insert from line st) -- Remember the line with a root user
+        | otherwise = (Just from, Map.delete from st) -- Forget there was a root used for this FROM
+    buildMap st _ = st
     --
     --
     isRoot user =
diff --git a/test/Spec.hs b/test/Spec.hs
--- a/test/Spec.hs
+++ b/test/Spec.hs
@@ -98,7 +98,7 @@
                         , "RUN something"
                         , "USER foo"
                         ]
-                in ruleCatches noRootUser $ Text.unlines dockerFile
+                in ruleCatchesNot noRootUser $ Text.unlines dockerFile
 
             it "warns on transitive root user" $
                 let dockerFile =
@@ -130,7 +130,7 @@
                         , "FROM scratch"
                         , "RUN something else"
                         ]
-                in ruleCatches noRootUser $ Text.unlines dockerFile
+                in ruleCatchesNot noRootUser $ Text.unlines dockerFile
 
             it "install sudo" $ do
                 ruleCatchesNot noSudo "RUN apt-get install sudo"