diff --git a/pkg/sentry/fsimpl/fuse/inode.go b/pkg/sentry/fsimpl/fuse/inode.go
index 880e761b6..8b7a08ed8 100644
--- a/pkg/sentry/fsimpl/fuse/inode.go
+++ b/pkg/sentry/fsimpl/fuse/inode.go
@@ -461,21 +461,20 @@ func (i *inode) RmDir(ctx context.Context, name string, child kernfs.Inode) erro
 
 // Rename implements kernfs.Inode.Rename.
 func (i *inode) Rename(ctx context.Context, oldname, newname string, child, dstDir kernfs.Inode) error {
-	fusefs := i.fs
-	task, creds := kernel.TaskFromContext(ctx), auth.CredentialsFromContext(ctx)
-
-	dstDirInode, ok := dstDir.(*inode)
-	if !ok {
-		return linuxerr.EXDEV
+	kernelTask := kernel.TaskFromContext(ctx)
+	if kernelTask == nil {
+		log.Warningf("fusefs.Inode.newEntry: couldn't get kernel task from context", i.nodeID)
+		return linuxerr.EINVAL
 	}
 
+	dstDirInode := dstDir.(*inode)
 	in := linux.FUSERenameIn{
 		Newdir:  primitive.Uint64(dstDirInode.nodeID),
 		Oldname: linux.CString(oldname),
 		Newname: linux.CString(newname),
 	}
-	req := fusefs.conn.NewRequest(creds, uint32(task.ThreadID()), i.nodeID, linux.FUSE_RENAME, &in)
-	res, err := i.fs.conn.Call(task, req)
+	req := i.fs.conn.NewRequest(auth.CredentialsFromContext(ctx), uint32(kernelTask.ThreadID()), i.nodeID, linux.FUSE_RENAME, &in)
+	res, err := i.fs.conn.Call(kernelTask, req)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/sentry/fsimpl/kernfs/filesystem.go b/pkg/sentry/fsimpl/kernfs/filesystem.go
index d69118846..90d05e396 100644
--- a/pkg/sentry/fsimpl/kernfs/filesystem.go
+++ b/pkg/sentry/fsimpl/kernfs/filesystem.go
@@ -681,6 +681,13 @@ func (fs *Filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 		return err
 	}
 	defer mnt.EndWrite()
+	oldParentDir := oldParentVD.Dentry().Impl().(*Dentry).Inode()
+	if err := oldParentDir.CheckPermissions(ctx, rp.Credentials(), vfs.MayWrite|vfs.MayExec); err != nil {
+		return err
+	}
+	if err := dstDir.inode.CheckPermissions(ctx, rp.Credentials(), vfs.MayWrite|vfs.MayExec); err != nil {
+		return err
+	}
 
 	srcDirVFSD := oldParentVD.Dentry()
 	srcDir := srcDirVFSD.Impl().(*Dentry)
diff --git a/test/syscalls/BUILD b/test/syscalls/BUILD
index 62b82d674..6f36e352b 100644
--- a/test/syscalls/BUILD
+++ b/test/syscalls/BUILD
@@ -566,6 +566,7 @@ syscall_test(
 
 syscall_test(
     size = "medium",
+    add_fusefs = True,
     add_overlay = True,
     test = "//test/syscalls/linux:rename_test",
 )