Kernel memory disclosure and crash via MPLS race

Out-of-bounds reads in Linux kernel MPLS allow local users to disclose kernel memory or crash the system through a table-resize race. During concurrent resize_platform_label_table activity, mpls_forward and mpls_dump_routes can read platform_labels and platform_label from different table generations, then index beyond the selected array. Exploitation requires CAP_NET_ADMIN in the target network namespace, which is reachable through enabled unprivileged user and network namespaces; the grounded consequences are kernel-memory disclosure and system interruption, not data modification.