Cloudflare said it deployed runtime access controls to mitigate the Copy Fail Linux vulnerability while its engineers prepared and tested patched kernels. The company reported no customer impact, no customer data at risk and no service disruption during its response.
The Linux kernel local privilege escalation vulnerability, tracked as CVE-2026-31431, was publicly disclosed under the name Copy Fail on April 29, 2026. It allows an unprivileged local user to gain root privileges on an affected system. Exploitation requires local code execution; the vulnerability does not itself provide remote access.
Cloudflare said its security and engineering teams assessed exposure, validated existing behavioral detections and searched for earlier exploitation while developing the runtime mitigation. The company reported finding no evidence of malicious exploitation in its environment.
A targeted mitigation while kernel updates proceeded
Cloudflare said most of its infrastructure was running custom kernels based on Linux 6.12 LTS when Copy Fail was disclosed, while some machines had begun moving to 6.18 LTS. Its regular process generated internal kernel builds approximately weekly, tested them in staging data centers and deployed them across its edge infrastructure through a four-week reboot cycle. Control plane reboots followed workload-specific schedules.
The company said the mainline fix preceded public disclosure, but the backport for the kernel line used by most of its infrastructure became available later. Deploying patched kernels also required staging tests and scheduled reboots, so engineers pursued a mitigation that could take effect without an immediate reboot.
One option was to remove the affected algif_aead kernel module and prevent it from loading again. Cloudflare said doing so would have disrupted production software that used the kernel cryptographic interface.
Instead, the company used a BPF Linux Security Module program to restrict access through the socket_bind security hook. For sockets in the affected AF_ALG family, the program checked the calling executable’s path against an allow-list. Approved binaries could bind; other callers were denied. Bind operations for other socket families passed through unchanged.
Before enforcing the policy, Cloudflare said it used prometheus-ebpf-exporter to monitor AF_ALG socket creation and identify the binaries using the interface. The company said those measurements confirmed that its known internal service was the only legitimate user.
Cloudflare described a staged deployment: first enable usage monitoring through configuration controls, then introduce the BPF LSM policy behind a separate enforcement gate after validating the allow-list. The approach was intended to restrict access to the vulnerable interface while preserving the production service’s access.
Detection and retrospective investigation
Cloudflare said its existing behavioral detection system flagged the exploit within minutes during authorized internal testing. The company described an execution chain beginning with a script interpreter, passing through the kernel cryptographic subsystem and ending at a privilege escalation binary. It said the detection required no new signature or rule change.
Investigators also searched centralized logs for exploit-related kernel traces covering the 48 hours before public disclosure. Cloudflare said they reviewed access logs, reconstructed interactive commands, checked system binaries against known-good package manifests, searched for persistence mechanisms and examined network connections for unusual activity.
The company reported that the investigation found no evidence of malicious exploitation. That finding reflects Cloudflare’s assessment of the activity and records it reviewed.
How Copy Fail affects cached files
Copy Fail involves the Linux kernel’s AF_ALG socket interface, which allows userspace programs to request cryptographic operations. The affected path combines authenticated encryption handling in the algif_aead module with file-backed memory references passed through the splice() system call.
Theori’s researchers described a controlled 4-byte write into the page cache, the operating system’s shared cache of file contents. Their default public exploit targets /usr/bin/su, a setuid-root executable. By modifying its cached contents and then executing it, an attacker can run injected code with root privileges.
The researchers said the write persists in the page cache even when the cryptographic operation returns an error. They described the exploit as changing cached file contents without changing the file on disk, allowing it to evade checks limited to the on-disk version.
Theori’s researchers said the upstream fix reverted an in-place cryptographic optimization introduced in 2017. The change separates input and output memory so that file-backed cache pages are no longer chained into the writable destination.
Patched-kernel rollout and follow-up
Cloudflare said kernel-update work continued alongside the runtime mitigation. Once the relevant upstream backport became available, its automation built a patched kernel, engineers began testing it in staging data centers and the longer reboot-based rollout resumed.
The runtime policy restricted access to the vulnerable interface, while the kernel fix addressed the underlying flaw. Cloudflare’s described deployment process included both measures, but the supplied account does not establish when every machine completed either mitigation or patching.
Cloudflare identified a review of kernel-subsystem usage across production services as follow-up work.
