Unprivileged user namespaces is a feature of Linux kernel that allows unprivileged users to create user namespaces and gain isolated root-like privileges within the new namespace. While it’s beneficial for application deployment, it breaks a critical security mechanism, Linux capabilities, and increases the risk of privilege escalation attacks. We analyzed 51 recent exploits from well-known databases such as exploitDB and found that 32 of them, which should have been protected by Linux capabilities mechanism, successfully escalated privileges by creating a new user namespace. To mitigate this risk, we propose a lightweight defense mechanism that introduces a custom capability check before creating user namespaces, controlling the scope of permissions and preventing malicious exploitation of user namespaces. This security enhancement may restore the effectiveness of Linux capabilities. Our prototype on Linux v6.6.3 demonstrates that our work works well with negligible performance impact. In addition, based on the analysis of new attacks we refine existing attack model and highlight the crucial role of attack preconditions—an often overlooked factor in the privilege escalation process.