selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99052
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-23 13:17:28 UTC
Updated2026-10-23 13:17:28 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts When an NFSv4 filesystem exported with security_label is mounted a second time, sget_fc() returns the existing superblock and nfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the superblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an early exit without setting SECURITY_LSM_NATIVE_LABELS in *set_kern_flags. nfs_get_root() then sees kflags without SECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on the shared nfs_server, silently disabling per-file labeling for both the new and the original mount. Commit 3815a245b501 ("security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock") fixed the same problem in selinux_sb_clone_mnt_opts(). The reused-superblock path for a plain second mount now goes through sb_set_mnt_opts rather than sb_clone_mnt_opts, so it needs the same treatment: on both SE_SBINITIALIZED early exits, set SECURITY_LSM_NATIVE_LABELS in *set_kern_flags when the superblock was already using SECURITY_FS_USE_NATVE.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected eb9ae686507bc5a5ca78e6b3fbe629cd5cc67864 a545def625860d4ccedc14fe45e884a62a041cef git Not specified
CNA Linux Linux affected eb9ae686507bc5a5ca78e6b3fbe629cd5cc67864 a6da93c625b3557dd23ff6db45d2d1bafeae1565 git Not specified
CNA Linux Linux affected eb9ae686507bc5a5ca78e6b3fbe629cd5cc67864 5509d498e1b9edafebd5a60ba3cb9ecfda23dc2b git Not specified
CNA Linux Linux affected eb9ae686507bc5a5ca78e6b3fbe629cd5cc67864 c997832414f1d846de0a1fa38d7d4f62ba2ea917 git Not specified
CNA Linux Linux affected eb9ae686507bc5a5ca78e6b3fbe629cd5cc67864 28b7260548af3d35773477993ad4e4de41578dd7 git Not specified
CNA Linux Linux affected 3.11 Not specified
CNA Linux Linux unaffected 3.11 semver Not specified
CNA Linux Linux unaffected 6.6.160 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.113 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.57 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.11 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/5509d498e1b9edafebd5a60ba3cb9ecfda23dc2b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a6da93c625b3557dd23ff6db45d2d1bafeae1565 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a545def625860d4ccedc14fe45e884a62a041cef 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/28b7260548af3d35773477993ad4e4de41578dd7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c997832414f1d846de0a1fa38d7d4f62ba2ea917 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report