diff --git a/core/lib/Drupal/Core/Session/UserSession.php b/core/lib/Drupal/Core/Session/UserSession.php
index da4f26d..912d755 100644
--- a/core/lib/Drupal/Core/Session/UserSession.php
+++ b/core/lib/Drupal/Core/Session/UserSession.php
@@ -141,15 +141,7 @@ public function hasPermission($permission) {
       return TRUE;
     }
 
-    $roles = \Drupal::entityManager()->getStorage('user_role')->loadMultiple($this->getRoles());
-
-    foreach ($roles as $role) {
-      if ($role->hasPermission($permission)) {
-        return TRUE;
-      }
-    }
-
-    return FALSE;
+    return $this->getRoleStorage()->isPermissionInRoles($permission, $this->getRoles());
   }
 
   /**
@@ -250,4 +242,14 @@ public function getHostname() {
     return $this->hostname;
   }
 
+  /**
+   * Returns the role storage object.
+   *
+   * @return \Drupal\user\RoleStorageInterface
+   *   The role storage object.
+   */
+  protected function getRoleStorage() {
+    return \Drupal::entityManager()->getStorage('user_role');
+  }
+
 }
diff --git a/core/modules/user/src/Entity/User.php b/core/modules/user/src/Entity/User.php
index d6cfe96..06f4f5c 100644
--- a/core/modules/user/src/Entity/User.php
+++ b/core/modules/user/src/Entity/User.php
@@ -244,15 +244,7 @@ public function hasPermission($permission) {
       return TRUE;
     }
 
-    $roles = \Drupal::entityManager()->getStorage('user_role')->loadMultiple($this->getRoles());
-
-    foreach ($roles as $role) {
-      if ($role->hasPermission($permission)) {
-        return TRUE;
-      }
-    }
-
-    return FALSE;
+    return $this->getRoleStorage()->isPermissionInRoles($permission, $this->getRoles());
   }
 
   /**
@@ -536,4 +528,14 @@ public static function baseFieldDefinitions(EntityTypeInterface $entity_type) {
     return $fields;
   }
 
+  /**
+   * Returns the role storage object.
+   *
+   * @return \Drupal\user\RoleStorageInterface
+   *   The role storage object.
+   */
+  protected function getRoleStorage() {
+    return \Drupal::entityManager()->getStorage('user_role');
+  }
+
 }
diff --git a/core/modules/user/src/RoleStorage.php b/core/modules/user/src/RoleStorage.php
index c875c93..72d0291 100644
--- a/core/modules/user/src/RoleStorage.php
+++ b/core/modules/user/src/RoleStorage.php
@@ -17,6 +17,16 @@ class RoleStorage extends ConfigEntityStorage implements RoleStorageInterface {
   /**
    * {@inheritdoc}
    */
+  public function isPermissionInRoles($permission, array $rids) {
+    return (bool) $this->getQuery()
+      ->condition('id', $rids)
+      ->condition('permissions.*', $permission)
+      ->execute();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
   public function deleteRoleReferences(array $rids) {
     // Remove the role from all users.
     db_delete('users_roles')
diff --git a/core/modules/user/src/RoleStorageInterface.php b/core/modules/user/src/RoleStorageInterface.php
index d094d5e..84cf99c 100644
--- a/core/modules/user/src/RoleStorageInterface.php
+++ b/core/modules/user/src/RoleStorageInterface.php
@@ -15,6 +15,19 @@
 interface RoleStorageInterface extends ConfigEntityStorageInterface {
 
   /**
+   * Returns whether a permission is in one of the passed in roles.
+   *
+   * @param string $permission
+   *   The permission.
+   * @param array $rids
+   *   The list of role IDs to check.
+   *
+   * @return bool
+   *   TRUE is the permission is in at least one of the roles. FALSE otherwise.
+   */
+  public function isPermissionInRoles($permission, array $rids);
+
+  /**
    * Delete role references.
    *
    * @param array $rids
diff --git a/core/tests/Drupal/Tests/Core/Session/UserSessionTest.php b/core/tests/Drupal/Tests/Core/Session/UserSessionTest.php
index 47f484f..d6ff1d1 100644
--- a/core/tests/Drupal/Tests/Core/Session/UserSessionTest.php
+++ b/core/tests/Drupal/Tests/Core/Session/UserSessionTest.php
@@ -93,17 +93,20 @@ protected function setUp() {
 
     $role_storage = $this->getMockBuilder('Drupal\user\RoleStorage')
       ->disableOriginalConstructor()
-      ->setMethods(array('loadMultiple'))
+      ->setMethods(array('isPermissionInRoles'))
       ->getMock();
     $role_storage->expects($this->any())
-      ->method('loadMultiple')
-      ->will($this->returnValueMap(array(
-        array(array(), array()),
-        array(NULL, $roles),
-        array(array('role_one'), array($roles['role_one'])),
-        array(array('role_two'), array($roles['role_two'])),
-        array(array('role_one', 'role_two'), array($roles['role_one'], $roles['role_two'])),
-      )));
+      ->method('isPermissionInRoles')
+      ->will($this->returnCallback(function ($permission, $rids) use ($roles) {
+        $result = FALSE;
+        foreach ($rids as $rid) {
+          if ($roles[$rid]->hasPermission($permission)) {
+            $result = TRUE;
+            break;
+          }
+        }
+        return $result;
+      }));
 
     $entity_manager = $this->getMock('Drupal\Core\Entity\EntityManagerInterface');
     $entity_manager->expects($this->any())