diff --git a/fs/namespace.c b/fs/namespace.c
index adb966833a4b..9e1717692be3 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1975,6 +1975,11 @@ struct vfsmount *clone_private_mount(const struct path *path)
 	if (!check_mnt(old_mnt))
 		goto invalid;
 
+	if (!ns_capable(old_mnt->mnt_ns->user_ns, CAP_SYS_ADMIN)) {
+		up_read(&namespace_sem);
+		return ERR_PTR(-EPERM);
+	}
+
 	if (has_locked_children(old_mnt, path->dentry))
 		goto invalid;