The flaw exists in the Linux kernel’s signal delivery routine, where a shared siginfo structure is reused across group sends. Because the send_signal_locked() function rewrites sender identifiers for the target namespace, a single recipient can alter information that will be used for the next signal. The result is that a process can spoof its identity to trusted kernel components. Based on the description, it is inferred that this weakness would be exploitable only by code that can run with kernel or elevated privileges, such as a local attacker executing a kernel module.

The issue is present in the Linux kernel itself, as indicated by the vendor entry "Linux:Linux" and the matching kernel CPE string. No particular version range is specified, meaning any kernel that implements the affected send_signal_locked routine before the committed fix could be vulnerable until a patch is applied. All distributions shipping a kernel that contains this routine are potentially impacted.

The CVSS score is not provided and the EPSS value is unavailable, so the public assessment of exploit likelihood is missing. The vulnerability is not listed in the CISA KEV catalog, indicating that it is not known to be actively exploited. Because signal handling operates in kernel mode, exploitation would generally require local access or an already loaded kernel module. Nevertheless, a successful exploitation could lead to privilege escalation or misattribution, representing a moderate to high risk in environments where signals are used for inter‑process control or privilege checks.