In the Linux kernel, the LANDLOCK_SCOPE_SIGNAL mechanism is intended to prevent a sandboxed process from sending signals to processes outside its Landlock domain. The vulnerability allows a sandboxed process to bypass this restriction through the asynchronous SIGIO delivery path. By configuring a file or socket with F_SETOWN, F_SETSIG, and O_ASYNC, a sandbox can cause the kernel to deliver a chosen signal to the entire process group. If the group includes a non‑sandboxed process – such as a supervisor or security monitor – the sandbox can kill or otherwise affect it. The flaw therefore undermines the isolation guarantees of Landlock and can lead to privilege escalation or denial‑of‑service against critical services.

All Linux kernel releases that precede the commit that records the domain for process‑group targets and exempts own‑group recipients are vulnerable. The fix is present in the mainline kernel starting with the commit that implements the recorded domain for every non single‑process target. Consequently, any system running a kernel version before that commit – regardless of distribution – remains exposed until the kernel is updated.

The CVSS score is not available, and the EPSS score is unspecified, but the flaw does not require external network access; a sandboxed process with local control suffices. Attackers can trigger the bypass by setting up a socket or file for SIGIO while running inside the sandbox. Because the vulnerability enables sending signals to arbitrary processes, it can result in privilege escalation and availability impact. The flaw is not listed in CISA KEV, indicating no documented widespread exploitation yet. Nevertheless, the risk remains significant for environments that expose untrusted sandboxed processes capable of arm SIGIO.