CVE-2026-99052: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

In the Linux kernel, the following vulnerability has been resolved:

selinux: preserve NATIVELABELS on already-initialized sb in setmntopts

When an NFSv4 filesystem exported with securitylabel is mounted a second time, sgetfc() returns the existing superblock and nfsgetroot() calls securitysbsetmntopts() again on it. Since the superblock is already SBINITIALIZED, selinuxsetmntopts() takes an early exit without setting SECURITYLSMNATIVELABELS in setkernflags. nfsgetroot() then sees kflags without SECURITYLSMNATIVELABELS set and clears NFSCAPSECURITYLABEL on the shared nfsserver, silently disabling per-file labeling for both the new and the original mount.

Commit 3815a245b501 ("security/selinux: fix SECURITYLSMNATIVELABELS on reused superblock") fixed the same problem in selinuxsbclonemntopts(). The reused-superblock path for a plain second mount now goes through sbsetmntopts rather than sbclonemntopts, so it needs the same treatment: on both SESBINITIALIZED early exits, set SECURITYLSMNATIVELABELS in setkernflags when the superblock was already using SECURITYFSUSENATVE.