diff --git a/sys/kern/kern_caps.c b/sys/kern/kern_caps.c
--- a/sys/kern/kern_caps.c
+++ b/sys/kern/kern_caps.c
@@ -98,10 +98,16 @@
 		pp = pfind(curproc->p_ppid);
 		if (pp == NULL)
 			return EINVAL;
-                lwkt_gettoken_shared(&pp->p_token);	/* protect cred */
+		lwkt_gettoken_shared(&pp->p_token);	/* protect cred */
+		if (pp->p_ucred->cr_uid != curproc->p_ucred->cr_uid ||
+		    pp->p_ucred->cr_prison != curproc->p_ucred->cr_prison) {
+			lwkt_reltoken(&pp->p_token);
+			PRELE(pp);
+			return EINVAL;
+		}
 		cred = pp->p_ucred;
 		crhold(cred);
-                lwkt_reltoken(&pp->p_token);
+		lwkt_reltoken(&pp->p_token);
 		PRELE(pp);				/* from pfind */
 	} else {
 		cred = curthread->td_ucred;