diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -1575,6 +1575,13 @@
 		if ((error = namei(&nd)) != 0)
 			return (error);
 		NDFREE(&nd, NDF_ONLY_PNBUF);
+		if ((nd.ni_resflags & NIRES_EMPTYPATH) != 0) {
+			error = priv_check(td, PRIV_VFS_FHOPEN);
+			if (error != 0) {
+				vrele(nd.ni_vp);
+				return (error);
+			}
+		}
 		error = kern_linkat_vp(td, nd.ni_vp, fd2, path2, segflag);
 	} while (error ==  EAGAIN || error == ERELOOKUP);
 	return (error);
@@ -1596,23 +1603,6 @@
 	    LOCKPARENT | SAVENAME | AUDITVNODE2 | NOCACHE, segflag, path, fd,
 	    &cap_linkat_target_rights, td);
 	if ((error = namei(&nd)) == 0) {
-		if ((nd.ni_resflags & NIRES_EMPTYPATH) != 0) {
-			error = priv_check(td, PRIV_VFS_FHOPEN);
-			if (error != 0) {
-				NDFREE(&nd, NDF_ONLY_PNBUF);
-				if (nd.ni_vp != NULL) {
-					if (nd.ni_dvp == nd.ni_vp)
-						vrele(nd.ni_dvp);
-					else
-						vput(nd.ni_dvp);
-					vrele(nd.ni_vp);
-				} else {
-					vput(nd.ni_dvp);
-				}
-				vrele(vp);
-				return (error);
-			}
-		}
 		if (nd.ni_vp != NULL) {
 			NDFREE(&nd, NDF_ONLY_PNBUF);
 			if (nd.ni_dvp == nd.ni_vp)