diff --git a/fs/namespace.c b/fs/namespace.c
index 2e939b783618..1c54c16c7bab 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2510,6 +2510,9 @@ struct vfsmount *clone_private_mount(const struct path *path)
 			return ERR_PTR(-EINVAL);
 	}
 
+        if (!ns_capable(old_mnt->mnt_ns->user_ns, CAP_SYS_ADMIN))
+		return ERR_PTR(-EPERM);
+
 	if (__has_locked_children(old_mnt, path->dentry))
 		return ERR_PTR(-EINVAL);