In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts When… (CVE-2026-99052)

The vulnerability involves the SELinux security module in the Linux kernel mishandling the SECURITY_LSM_NATIVE_LABELS flag on superblocks reused during a second mount of an NFSv4 filesystem exported with security_label. Specifically, when the superblock is already initialized, the selinux_set_mnt_opts() function exits early without setting SECURITY_LSM_NATIVE_LABELS in the kernel flags, leading to the clearing of NFS_CAP_SECURITY_LABEL on the shared nfs_server. This disables per-file labeling silently for both the new and original mounts. The fix ensures that on early exits due to an already initialized superblock, the SECURITY_LSM_NATIVE_LABELS flag is properly set in the kernel flags, preserving the expected security labeling behavior.

The vulnerability causes the silent disabling of per-file security labeling on NFSv4 mounts using SELinux security labels when the filesystem is mounted multiple times. This could lead to a loss of expected security enforcement on files accessed via NFS, potentially weakening the security posture of systems relying on SELinux labeling for access control on NFS shares.

A fix has been implemented in the Linux kernel (commit 3815a245b501) that correctly sets the SECURITY_LSM_NATIVE_LABELS flag on reused superblocks during mount option processing. Users should update to a Linux kernel version that includes this fix to ensure proper SELinux labeling behavior on NFSv4 mounts. No additional mitigation steps are indicated.