diff --git a/infra/conf/wireguard.go b/infra/conf/wireguard.go
index d06bf6890efd..acd658efa2a8 100644
--- a/infra/conf/wireguard.go
+++ b/infra/conf/wireguard.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/base64"
 	"encoding/hex"
+	"fmt"
 	"strings"
 
 	"github.com/xtls/xray-core/common/errors"
@@ -119,13 +120,19 @@ func (c *WireGuardConfig) Build() (proto.Message, error) {
 	}
 
 	config.IsClient = c.IsClient
+	kernelTunSupported, err := wireguard.KernelTunSupported()
+	if err != nil {
+		errors.LogWarning(context.Background(), fmt.Sprintf("Failed to check kernel TUN support: %v. This may indicate that your OS doesn't support kernel mode or you lack the necessary permissions. Please ensure you have the required privileges.", err))
+		config.KernelMode = false
+		return config, nil
+	}
 	if c.KernelMode != nil {
 		config.KernelMode = *c.KernelMode
-		if config.KernelMode && !wireguard.KernelTunSupported() {
+		if config.KernelMode && !kernelTunSupported {
 			errors.LogWarning(context.Background(), "kernel mode is not supported on your OS or permission is insufficient")
 		}
 	} else {
-		config.KernelMode = wireguard.KernelTunSupported()
+		config.KernelMode = kernelTunSupported
 		if config.KernelMode {
 			errors.LogDebug(context.Background(), "kernel mode is enabled as it's supported and permission is sufficient")
 		}
diff --git a/proxy/wireguard/tun_default.go b/proxy/wireguard/tun_default.go
index 4d0567af0029..50a509444c21 100644
--- a/proxy/wireguard/tun_default.go
+++ b/proxy/wireguard/tun_default.go
@@ -11,6 +11,6 @@ func createKernelTun(localAddresses []netip.Addr, mtu int, handler promiscuousMo
 	return nil, errors.New("not implemented")
 }
 
-func KernelTunSupported() bool {
-	return false
+func KernelTunSupported() (bool, error) {
+	return false, nil
 }
diff --git a/proxy/wireguard/tun_linux.go b/proxy/wireguard/tun_linux.go
index 22c638d381f1..b8ce6488cfa3 100644
--- a/proxy/wireguard/tun_linux.go
+++ b/proxy/wireguard/tun_linux.go
@@ -231,10 +231,15 @@ func createKernelTun(localAddresses []netip.Addr, mtu int, handler promiscuousMo
 	return out, nil
 }
 
-func KernelTunSupported() bool {
-	// run a superuser permission check to check
-	// if the current user has the sufficient permission
-	// to create a tun device.
+func KernelTunSupported() (bool, error) {
+	var hdr unix.CapUserHeader
+	hdr.Version = unix.LINUX_CAPABILITY_VERSION_3
+	hdr.Pid = 0 // 0 means current process
 
-	return unix.Geteuid() == 0 // 0 means root
+	var data unix.CapUserData
+	if err := unix.Capget(&hdr, &data); err != nil {
+		return false, fmt.Errorf("failed to get capabilities: %v", err)
+	}
+
+	return (data.Effective & (1 << unix.CAP_NET_ADMIN)) != 0, nil
 }