When an NFSv4 share exported with security labeling is mounted a second time, the kernel reuses an already initialized superblock and skips setting the SECURITY_LSM_NATIVE_LABELS flag. This causes the NFS server to clear the NFS_CAP_SECURITY_LABEL capability, disabling per‑file SELinux labels for both the original and new mount. The result is that SELinux policy no longer applies to those mounts, which can lead to unauthorized reads or writes. The weakness is a failure to correctly initialize security attributes on reused resources (CWE‑281).

The flaw affects all Linux kernel versions that contain the buggy path before the commit that adds the missing flag. Both the generic Linux distribution kernels and custom builds will be vulnerable if they have not applied the upstream patch. The specific affected vendor is Linux, product is the Linux kernel, and versions are unspecified until the patch is deployed.

The vulnerability is not listed in the CISA KEV catalog, and the EPSS score of < 1% indicates a low likelihood of exploitation. The CVSS score of 5.7 places this issue in the medium severity range. The flaw allows an attacker who can mount or remount a NFSv4 share that was exported with the security_label option to have the NFS server inadvertently clear its SECURITY_CAPABILITY flag, disabling SELinux labels on both the existing and new mounts. This loss of mandatory access control could enable unauthorized file access if the attacker can control or influence such mounts, but the requirement to mount the share limits the attack surface.