How Cloudflare responded to the “Copy Fail” Linux vulnerability (opens in new tab)
Cloudflare assessed the “Copy Fail” Linux privilege-escalation vulnerability (CVE-2026-31431) immediately after its disclosure on April 29, 2026. Its existing kernel update process meant the relevant fixes were already deployed across most infrastructure, while behavioral detections could identify exploitation attempts within minutes. Cloudflare reported no environmental impact, customer data exposure, or service disruption. ## Cloudflare’s Linux Kernel Update Process - Cloudflare runs custom Linux kernels based on community Long-Term Support releases across datacenters in 330 cities. - Automated jobs build updated kernels approximately weekly from upstream security and stability fixes. - New builds are tested in staging before global deployment. - The Edge Reboot Release pipeline rolls updates through edge infrastructure on a four-week cycle. - Control-plane systems generally use the newest kernel, with reboots scheduled based on workload requirements. - By the time vulnerabilities are publicly disclosed, fixes are typically already present in stable LTS releases and deployed by Cloudflare. - At disclosure, most systems used Linux 6.12 LTS, while some were transitioning to 6.18 LTS. ## How Copy Fail Worked - The vulnerability affected the Linux kernel’s `AF_ALG` interface, which lets unprivileged processes access cryptographic operations through the `algif_aead` module. - Attackers could combine: - `sendmsg()` or `splice()` to submit data - `recvmsg()` to execute the cryptographic operation - Page-cache references to redirect writes into files - An older in-place optimization allowed the AEAD implementation to write beyond the intended output boundary. - The `authencesn` wrapper performed a controllable four-byte out-of-bounds write. - By using `splice()`, an attacker could target pages belonging to any readable file and control: - The file being modified - The write offset - The four bytes written ## Privilege Escalation Through `/usr/bin/su` - The public exploit targeted `/usr/bin/su`, a setuid-root binary commonly present on Linux systems. - The attacker populated the binary’s contents in the page cache and connected those cached pages to a crypto scatterlist. - Shellcode was supplied through AAD bytes in `sendmsg()`. - `splice()` parameters controlled the target offset in the binary. - Although `recvmsg()` returned `-EBADMSG`, the out-of-bounds write had already modified the shared page cache. - Executing `/usr/bin/su` then loaded the modified cached pages, causing the injected code to run with root privileges. ## Upstream Fix and Cloudflare’s Response - The upstream fix, commit `a664bf3d603d`, reverted the 2017 in-place optimization responsible for the flaw. - After disclosure, Cloudflare’s security and kernel engineering teams worked in parallel to: - Identify vulnerable kernel versions - Assess infrastructure exposure - Review the exploit technique - Validate behavioral detections - Existing monitoring could detect the exploit pattern within minutes. - Cloudflare concluded that its infrastructure was not impacted and that no customer data or services were affected. Cloudflare’s experience demonstrates the value of maintaining patched LTS kernels, automating frequent kernel builds and staged rollouts, and combining preventative patching with behavioral exploit detection.