diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py
index 0d64861b2..493a1de9a 100644
--- a/volatility3/framework/plugins/linux/malware/process_spoofing.py
+++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py
@@ -17,9 +17,11 @@ from volatility3.plugins.linux import pslist
 vollog = logging.getLogger(__name__)
 
 
-# https://github.com/SolitudePy/linux-mal
 class ProcessSpoofing(plugins.PluginInterface):
-    """Detects process spoofing by comparing executable path to cmdline & comm fields"""
+    """Detects process spoofing by comparing executable path to cmdline & comm fields.
+
+    Examples of such behavior can be found here: https://github.com/SolitudePy/linux-mal
+    """
 
     _required_framework_version = (2, 27, 0)
     _version = (1, 1, 0)
@@ -101,7 +103,12 @@ class ProcessSpoofing(plugins.PluginInterface):
         task: interfaces.objects.ObjectInterface,
     ) -> Optional[str]:
         """
-        Extract the command line arguments and return the basename of the first argument
+        Extract the command line arguments and return the basename of the first argument.
+
+        Notes:
+            The read length is capped at ``MAX_ARG_STRLEN`` (32 * 4096) per the
+            kernel limit defined in ``include/uapi/linux/binfmts.h`` (see
+            linux.git commit f6031913338f1dad5bd8cb7286ff4e53644b6940).
 
         Args:
             context: The context to operate on