diff --git a/sys/kern/imgact_binmisc.c b/sys/kern/imgact_binmisc.c
index af8f78cee59..cdab7ebf0a7 100644
--- a/sys/kern/imgact_binmisc.c
+++ b/sys/kern/imgact_binmisc.c
@@ -434,6 +434,8 @@ sysctl_kern_binmisc(SYSCTL_HANDLER_ARGS)
 			return (error);
 		if (IBE_VERSION != xbe.xbe_version)
 			return (EINVAL);
+		if ((xbe.xbe_flags & ~IBF_VALID_UFLAGS) != 0)
+			return (EINVAL);
 		if (interp_list_entry_count == IBE_MAX_ENTRIES)
 			return (ENOSPC);
 		error = imgact_binmisc_add_entry(&xbe);
diff --git a/sys/sys/imgact_binmisc.h b/sys/sys/imgact_binmisc.h
index ef976ade464..add100110fd 100644
--- a/sys/sys/imgact_binmisc.h
+++ b/sys/sys/imgact_binmisc.h
@@ -53,6 +53,8 @@
 #define	IBF_ENABLED	0x0001	/* Entry is active. */
 #define	IBF_USE_MASK	0x0002	/* Use mask on header magic field. */
 
+#define	IBF_VALID_UFLAGS	0x0003	/* Bits allowed from userland. */
+
 /*
  * Used with sysctlbyname() to pass imgact bin misc entries in and out of the
  * kernel.