Kernel crash via exiting-task namespace null dereference

A null pointer dereference in Linux kernel RDS TCP sysctls allows local users to crash the kernel during task exit via acct(2). The rds_tcp_{rcv,snd}buf sysctl handlers read a network namespace through current->nsproxy even though that pointer can be NULL while the current task exits, causing a kernel Oops. Reachability requires local low-privileged access and execution of the affected RDS sysctl path during task teardown; the reported consequence is a kernel crash, not data disclosure or modification.