--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -739,6 +739,16 @@
 	    caps_priv_check(so->so_cred, SYSCAP_RESTRICTEDROOT) != 0)
 		gotoerr(EPERM);
 
+	/*
+	 * Installing a genmask permanently consumes kernel memory: the
+	 * per-CPU rtmask trees only ever grow (rn_addmask allocations
+	 * are never freed) and the key space is attacker-chosen.  Require
+	 * privilege even for RTM_GET when a genmask is supplied.
+	 */
+	if (rtinfo.rti_genmask != NULL && rtm->rtm_type == RTM_GET &&
+	    caps_priv_check(so->so_cred, SYSCAP_RESTRICTEDROOT) != 0)
+		gotoerr(EPERM);
+
 	if (rtinfo.rti_genmask != NULL) {
 		error = rtmask_add_global(rtinfo.rti_genmask,
 		    rtm->rtm_type != RTM_GET ?