When an NFSv4 share exported with security labeling is mounted a second time, the kernel reuses an already initialised superblock and skips setting the SECURITY_LSM_NATIVE_LABELS flag. This causes the NFS server to clear the NFS_CAP_SECURITY_LABEL capability, thereby disabling per‑file SELinux labels for both the original and new mount. The result is that SELinux policy no longer applies to those mounts, which can lead to unauthorized reads or writes and privilege escalation. The weakness is a failure to correctly initialise security attributes on reused resources (CWE‑284).

The flaw affects all Linux kernel versions that contain the buggy path before the commit that adds the missing flag. Both the generic Linux distribution kernels and custom builds will be vulnerable if they have not applied the upstream patch. The specific affected vendor is Linux, product is the Linux kernel, and versions are unspecified until the patch is deployed.

The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, but the impact on SELinux enforcement is significant. Exploitation requires the ability to mount (or remount) an NFSv4 share that was previously exported with security_label. An attacker who can achieve this can bypass SELinux controls on two separate mounts of the same share, potentially escalating privileges or exfiltrating data. The security assessment rates this as a high‑severity flaw due to the loss of mandatory access control but the public exploit probability remains uncertain as no exploit has yet been documented.