diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index 509dac77af611b62ecc8ac0d363a137d158ff30b..3fe05fb5d14592a7b34d4ce545d12a27d937e7dd 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -156,6 +156,9 @@ struct dentry *ovl_decode_real_fh(struct ovl_fs *ofs, struct ovl_fh *fh,
 	struct dentry *real;
 	int bytes;
 
+	if (!capable(CAP_DAC_READ_SEARCH))
+		return NULL;
+
 	/*
 	 * Make sure that the stored uuid matches the uuid of the lower
 	 * layer where file handle will be decoded.
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index 44b4b62a8ac891268714cc8c5b05e0426cbc19e4..ced63c79e9ddcace5d22ee30edc8803c38f29516 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -50,6 +50,9 @@ const struct cred *ovl_override_creds(struct super_block *sb)
  */
 int ovl_can_decode_fh(struct super_block *sb)
 {
+	if (!capable(CAP_DAC_READ_SEARCH))
+		return 0;
+
 	if (!sb->s_export_op || !sb->s_export_op->fh_to_dentry)
 		return 0;