CVE-2026-93222

A flaw was found in the Linux kernel's signal handling subsystem. When dispatching signals to a group of processes across different namespaces, the kernel modified shared signal metadata in place rather than copying it for each recipient. A local user could exploit this behavior to cause recipient processes in different namespaces to observe incorrect sender identifiers, such as process IDs and user IDs. This issue can lead to credential confusion and potentially bypass access controls or trust assumptions in receiving applications.

This vulnerability is rated as having a Low impact because exploitation requires existing local system access and specific inter-namespace signaling scenarios that generally yield inaccurate process or user identifiers rather than privilege escalation or kernel compromise. Under typical configurations, applications rarely base security-critical authorization decisions strictly on signal sender metadata received across namespace boundaries. Consequently, the practical risk to containerized environments and multi-tenant systems is minimal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.