CVE-2026-31679 openvswitch: validate MPLS set/set_masked payload length