The Linux kernel’s MPLS implementation suffered a race condition when the platform_label table was resized while a read path guarded by RCU was executing. Under these conditions the reader could observe an inconsistent view of the platform_label versus platform_labels structures, producing out‑of‑bounds memory accesses. Because the code runs in kernel space, such corruption could enable privilege escalation or denial of service. The patch introduces a seqcount guard so that read paths obtain a consistent snapshot, removing the unsafe accesses.

All Linux kernel releases without the seqcount protection in the MPLS code. The vulnerability exists in builds preceding commit 5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef and 629ec78ef8608d955ce217880cdc3e1873af3a15; any version that has not incorporated these commits is affected.

The CVSS score of 7.1 denotes a high‑severity vulnerability, while the EPSS score of <1% indicates a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, but it remains a high‑risk issue for systems that can be influenced by local attackers capable of sending crafted MPLS packets or manipulating routes while a resize operation is underway. Exploitation would result in kernel memory corruption, potentially granting the attacker elevated privileges or forcing a system reboot.