diff --git a/sys/kern/kern_varsym.c b/sys/kern/kern_varsym.c
--- a/sys/kern/kern_varsym.c
+++ b/sys/kern/kern_varsym.c
@@ -162,7 +162,15 @@
 	}
 	/* fall through */
     case VARSYM_USER:
-	/* XXX check jail / implement per-jail user */
+	/* XXX check jail / implement per-jail user.
+	 * Until per-jail USER varsym namespaces exist, require privilege
+	 * to set USER varsyms from inside a jail to avoid cross-jail sharing
+	 * of per-UID varsym state. */
+	if (lp != NULL &&
+	    (error = caps_priv_check_td(td, SYSCAP_NOVARSYM_SYS)) != 0)
+	{
+	    break;
+	}
 	/* fall through */
     case VARSYM_PROC:
 	if (uap->data) {