A 802.11 network, unlike a wired network, use acknowledgments to indicate that a frame was received successfully. It is used because the link is so lossy that most upper layers would be unable to cope with the sheer loss rate, so a lack of an acknowledgment will result in a retransmission. And it solves another problem: a 802.11 network is a shared media network, so if two stations send at exactly the same time, a collision occurs, and the frame is lost for both.
If two WLAN stations use the same MAC address in an open network, then the network can be rapidly brought down for both stations, because reception of data would likely fail:
If both station successfully receives a frame from the AP, both will acknowledge at the same time. And when i mean "same time", it is 10µs after the frame reception has ended. So it is guaranteed that both acknowledgment will collide with each other, and the AP will not receive it, so will retransmit.
If one station receives a frame successfully, but not the other, then the first station will acknowledge, and the other station will never receive the frame.
As such, when your network is completely borked down, disconnection or huge performance loss will occur, and the first to disconnect loses.
If your network is protected by WPA/RSN-PSK (without SAE), and both station knows the PSK, there is another problem: the PSK is not the encryption key by itself, but is used to derive an randomly generated temporary encryption key during a Four Way Handshake.
While a station is connected, if another station initiates a connection normally, then the AP will most likely forget the old encryption key and will use the one negotiated by the new 4 Way handshake. Depending on the implementation of the previous station, it may disconnect silently, or will participate with the new 4 way handshake. If both station participates with the same handshake, due to the way the 4 way handshake is typically implemented, the first station to respond wins, and the other station will disconnect, because it will fail to authenticate the AP.
And if the attacker retrieve the temporal encryption key (e.g. by eavesdropping the 4 way handshake done by the previous station, and knowing the PSK), he will have trouble to inject frames: each frame have an anti-replay sequence number, and if the AP detects replays, it knows that there is an attacker somewhere. because CCMP is secure, the AP may choose to simply ignore detected replays, so, again, the first one to send a packet with an acceptable sequence number wins. And, in top of that, you also still have the ACK collision problem.
So if the attacker want to inject frames without disconnecting the other station, it need to be more smart : he may transmit frames at will, but should not acknowledge received frames, and must have a better link quality that the original station to not loose too many frames. The attacker's work is much simpler if he can use the same IP address but with a different MAC address, and ignore all ARP requests: he can inject IP data, and will miss half the received data (depending on its link quality), but will not degrade the connectivity of the other station in any way.
If he has to use the same MAC address, then he may inject frames only if the network is open, wait for the acknowledgment, and retry if the acknowledgment is not received, and hope that the previous station is not too confused by receiving acknowledgment when not expected. The attacker must still passively monitor the channel and will still miss a lot of the inbound data.
Attacking is hard, even if 802.11 make it easy.
And by the way, ifconfig and route are deprecated on linux. Use ip link, ip addr and ip route instead. Also, you can use ip link set wlan0 address xx:xx:xx:xx:xx:xx instead of macchanger :
#!/bin/sh
ip link set wlan0 down
ip link set wlan0 address ac:81:12:a2:4e:3a
ip addr add 192.168.1.5/24 dev wlan0
ip link set wlan0 up
ip route add default via 192.168.1.1
