CVE-2026-99052

In the Linux kernel, the following vulnerability has been resolved:

selinux: preserve NATIVE LABELS on already-initialized sb in set mnt opts

When an NFSv4 filesystem exported with security label is mounted a second time, sget fc() returns the existing superblock and nfs get root() calls security sb set mnt opts() again on it. Since the superblock is already SB INITIALIZED, selinux set mnt opts() takes an early exit without setting SECURITY LSM NATIVE LABELS in *set kern flags. nfs get root() then sees kflags without SECURITY LSM NATIVE LABELS set and clears NFS CAP SECURITY LABEL on the shared nfs server, silently disabling per-file labeling for both the new and the original mount.

Commit 3815a245b501 ("security/selinux: fix SECURITY LSM NATIVE LABELS on reused superblock") fixed the same problem in selinux sb clone mnt opts(). The reused-superblock path for a plain second mount now goes through sb set mnt opts rather than sb clone mnt opts, so it needs the same treatment: on both SE SBINITIALIZED early exits, set SECURITY LSM NATIVE LABELS in *set kern flags when the superblock was already using SECURITY FS USE NATVE.