A new attack path is discovered in Linux privilege escalation attacks. Among the 50 exploits we have collected over the past 3 years, 19 leverage usermode helper to execute arbitrary code with root privileges, making it the most prevalent attack method. Existing research focuses on protecting permission mechanisms but falls short, as the attackers don’t attempt to modify their permissions. Instead, they exploit the regular routine of usermode helper by tampering with the path of usermode helper file which the kernel is about to execute. To address this, we propose a lightweight defense mechanism based on the fine-grained access control provided by Linux capability. The novelty of our approach lies in the fact that we didn’t use capability as a process property. Instead, we attach capabilities to valid usermode helper files and verify these files before execution. We identify the optimal point for insertion capability checks by statically analyzing kernel source code through LLVM. Our prototype implementation on Linux v6.6.3 demonstrates that our scheme effectively blocks these privilege escalation attacks with negligible performance overhead.