Ever heard of Copy Fail? How Cloudflare shut down a Linux kernel bug with bpf-lsm!

Hey everyone, it's Shii-chan! Today I've got a story that's a little scary but honestly pretty cool: how Cloudflare handled a Linux kernel vulnerability behind the scenes.

Cloudflare Blog blog.cloudflare.com

What was announced?

This is a response write-up from Cloudflare's Blog about a Linux kernel vulnerability called Copy Fail (CVE-2026-31431). It's a local privilege escalation bug disclosed on April 29, 2026, and Cloudflare rode it out across its global fleet with zero customer impact and no sign of exploitation.

Why it matters

Copy Fail hid inside the algif_aead module of the Linux kernel's crypto API. That module lets user space reach the kernel's AEAD crypto through AF_ALG sockets, but the authencesn wrapper's in-place path wrote 4 bytes past the legitimate output region, an out-of-bounds write.

Here's the scary part. By splicing target file pages in with splice(), an attacker can control where the write lands and what 4 bytes get written. The default exploit aims at the setuid-root /usr/bin/su, injecting shellcode to grab root. A regular user becoming admin, the classic nightmare.

What changes

The neat thing is that Cloudflare didn't scramble after disclosure, its existing tooling caught the pattern within minutes. Endpoint detection flagged the exploit chain with no signature update, no rule change, and no human in the loop.

flagged it within minutes ... without a signature update, without a rule change, and without human intervention.

Then the team swept 48 hours of logs from before disclosure to check for real abuse. All clear. No data at risk, no service disruption at any point.

Dive Deep

The first idea was to just disable the module.

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

That failed, because legitimate software depended on the kernel crypto API, so ripping it out broke things. They rolled it back in staging before it ever hit production.

Enter the surgical fix built on bpf-lsm. It hooks socket_bind and only lets allow-listed binaries open AF_ALG sockets, denying everyone else. The module stays alive, but the dangerous door gets shut.

To avoid breaking a real service, they first measured which binaries actually used AF_ALG fleet-wide with prometheus-ebpf-exporter, confirming the one legitimate user before enforcing. So careful!

You can check whether it's working with a single line.

python3 -c 'import socket; s = socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0); s.bind(("aead","authencesn(hmac(sha256),cbc(aes))"));'

A protected machine returns PermissionError: [Errno 1] Operation not permitted.

And of course they fixed the root cause. The upstream commit a664bf3d603d reverts a 2017 in-place optimization, and Cloudflare built a backported kernel for its main LTS line and shipped it through staged reboot automation. For context, Cloudflare runs a huge Linux fleet across 330 cities, mostly on 6.12 LTS with some moving to 6.18 LTS, rebuilding custom kernels roughly weekly.

Wrap-up

• Copy Fail (CVE-2026-31431) is a local privilege escalation from an out-of-bounds write in algif_aead that can hand over root
• Cloudflare spotted it in minutes with existing behavioral detection and confirmed zero abuse across 48 hours of history
• Disabling the module broke software and failed, so they switched to an allow-list surgical fix with bpf-lsm and it worked
• They shipped a kernel with the upstream commit a664bf3d603d via staged reboots, with zero customer impact

If you run kernel-level operations or incident response, or you want to harden things with eBPF and LSM, this one's for you. Even I came away impressed by the "keep the module, just shut the door" mindset.