The Linux kernel’s MPLS implementation has a race condition between RCU‑protected code paths (mpls_forward, mpls_dump_routes) and a concurrent resize of the platform_label table under platform_mutex. When a reader sees an inconsistent view, it can access memory beyond the intended bounds, leading to out‑of‑bounds accesses. This flaw is an instance of buffer overread (CWE‑125) and a race condition (CWE‑362, CWE‑367). Because it occurs in kernel space, the resulting memory corruption can be leveraged for privilege escalation or denial of service.

All Linux kernel releases that lack the seqcount guard in the MPLS code are vulnerable. The flaw exists in builds preceding the commits 5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef and 629ec78ef8608d955ce217880cdc3e1873af3a15; any version that has not incorporated these commits is affected. Affected platforms include Linux kernel 7.0 releases from rc1 through rc6 and all earlier stable releases.

Based on the description, it is inferred that the attacker would need to trigger local MPLS packet handling or route manipulation while a concurrent resize operation is underway. The likely attack vector is local or privileged. The CVSS score of 7.1 indicates a high‑severity vulnerability, and the EPSS score of <1% suggests a low probability of widespread exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, but for systems that can be influenced by local attackers, achieving kernel memory corruption could grant elevated privileges or cause a system reboot.