diff --git a/sys/kern/kern_linker.c b/sys/kern/kern_linker.c
--- a/sys/kern/kern_linker.c
+++ b/sys/kern/kern_linker.c
@@ -945,6 +945,14 @@
     struct kld_file_stat* stat;
     int namelen;
 
+    /*
+     * Module load/unload are gated by SYSCAP_NOKLD; the query path that
+     * discloses each module's base address and size must be gated too,
+     * otherwise any local user can defeat KASLR and map the kernel layout.
+     */
+    if ((error = caps_priv_check_self(SYSCAP_NOKLD)) != 0)
+	return error;
+
     lockmgr(&kld_lock, LK_EXCLUSIVE);
     lf = linker_find_file_by_id(uap->fileid);
     if (!lf) {
@@ -1030,6 +1038,14 @@
     struct kld_sym_lookup lookup;
     int error = 0;
 
+    /*
+     * Symbol resolution returns the absolute runtime address of any kernel
+     * symbol to the caller; gate it with SYSCAP_NOKLD to match load/unload
+     * and prevent an unprivileged user from defeating KASLR.
+     */
+    if ((error = caps_priv_check_self(SYSCAP_NOKLD)) != 0)
+	return error;
+
     lockmgr(&kld_lock, LK_EXCLUSIVE);
     if ((error = copyin(uap->data, &lookup, sizeof(lookup))) != 0)
 	goto out;