diff --git a/lib/libkvm/kvm.c b/lib/libkvm/kvm.c
index 6c19a1440d22..4ea1ff6fec55 100644
--- a/lib/libkvm/kvm.c
+++ b/lib/libkvm/kvm.c
@@ -166,7 +166,7 @@ _kvm_open(kvm_t *kd, const char *uf, const char *mf, int flag, char *errout)
 	if (mf == 0)
 		mf = _PATH_MEM;
 
-	if ((kd->pmfd = open(mf, flag, 0)) < 0) {
+	if ((kd->pmfd = open(mf, flag | O_CLOEXEC, 0)) < 0) {
 		_kvm_syserr(kd, kd->program, "%s", mf);
 		goto failed;
 	}
@@ -179,10 +179,6 @@ _kvm_open(kvm_t *kd, const char *uf, const char *mf, int flag, char *errout)
 		_kvm_syserr(kd, kd->program, "empty file");
 		goto failed;
 	}
-	if (fcntl(kd->pmfd, F_SETFD, FD_CLOEXEC) < 0) {
-		_kvm_syserr(kd, kd->program, "%s", mf);
-		goto failed;
-	}
 	if (S_ISCHR(st.st_mode)) {
 		/*
 		 * If this is a character special device, then check that
@@ -194,11 +190,8 @@ _kvm_open(kvm_t *kd, const char *uf, const char *mf, int flag, char *errout)
 			kd->vmfd = open(_PATH_DEVNULL, O_RDONLY);
 			return (kd);
 		} else if (strcmp(mf, _PATH_MEM) == 0) {
-			if ((kd->vmfd = open(_PATH_KMEM, flag)) < 0) {
-				_kvm_syserr(kd, kd->program, "%s", _PATH_KMEM);
-				goto failed;
-			}
-			if (fcntl(kd->vmfd, F_SETFD, FD_CLOEXEC) < 0) {
+			if ((kd->vmfd = open(_PATH_KMEM, flag | O_CLOEXEC)) <
+			    0) {
 				_kvm_syserr(kd, kd->program, "%s", _PATH_KMEM);
 				goto failed;
 			}
@@ -210,11 +203,7 @@ _kvm_open(kvm_t *kd, const char *uf, const char *mf, int flag, char *errout)
 	 * Initialize the virtual address translation machinery,
 	 * but first setup the namelist fd.
 	 */
-	if ((kd->nlfd = open(uf, O_RDONLY, 0)) < 0) {
-		_kvm_syserr(kd, kd->program, "%s", uf);
-		goto failed;
-	}
-	if (fcntl(kd->nlfd, F_SETFD, FD_CLOEXEC) < 0) {
+	if ((kd->nlfd = open(uf, O_RDONLY | O_CLOEXEC, 0)) < 0) {
 		_kvm_syserr(kd, kd->program, "%s", uf);
 		goto failed;
 	}