The vulnerability arises when LANDLOCK_SCOPE_SIGNAL, which is meant to prevent a sandboxed process from signaling processes outside its domain, can be bypassed through the asynchronous SIGIO delivery path. By configuring a file or socket with fcntl(fd, F_SETOWN), fcntl(fd, F_SETSIG), and O_ASYNC, a sandboxed process can cause the kernel to deliver a chosen signal to the entire process group, potentially including non‑sandboxed processes such as supervisors or security monitors. This allows the sandbox to kill or otherwise interfere with other processes, undermining the isolation guarantees of Landlock.

All Linux kernel releases published before the commit that records the domain for process‑group targets and exempts own‑group recipients are vulnerable. The fix is incorporated in the mainline kernel with the commit that implements these changes. Therefore any system running a kernel version older than that commit, regardless of distribution, remains exposed until the kernel is updated.

The CVSS score of 8.4 indicates a high severity vulnerability, while the EPSS score of <1% suggests a low probability of exploitation at this time. The flaw is not listed in CISA KEV, and no widespread exploitation has been documented. It is inferred that the vulnerability does not require external network access; a sandboxed process with control over a file or socket can trigger the bypass from within its own environment. The flaw can enable privilege escalation or denial of service by allowing a sandboxed process to signal processes outside its intended domain.