Cloudflare Responds to Linux "Copy Fail" CVE‑2026‑31431
Patch the kernel to the latest LTS (6.18) and deploy the bpf‑lsm mitigation immediately.
Patch all edge nodes to the latest LTS kernel, deploy the bpf‑lsm mitigation, and verify behavioral detection is active.
Summary
On 29 April 2026, Cloudflare faced the Linux kernel local privilege escalation CVE‑2026‑31431, dubbed “Copy Fail”. The vulnerability allowed an unprivileged process to write 4 bytes past the intended output region in the kernel crypto API, enabling root escalation via manipulation of setuid binaries such as /usr/bin/su. Cloudflare’s infrastructure runs custom kernel builds based on LTS 6.12 and 6.18, with weekly automated builds and a four‑week Edge Reboot Release cycle. By the time the CVE was disclosed, most edge nodes were on 6.12 and a subset had begun moving to 6.18, meaning the patch was already available in the LTS stream.
Cloudflare’s security team immediately mapped the blast radius, validated that their behavioral detection engine would flag the exploit pattern within minutes, and began threat hunting across 48 hours of logs. An initial mitigation attempt in staging was rolled back due to a dependency conflict, after which a bpf‑lsm runtime mitigation was drafted and tested. By 30 April 2026, the mitigation was production‑ready and no customer data or services were impacted. The incident demonstrated the effectiveness of Cloudflare’s automated patching pipeline and real‑time detection without needing a signature update.
Key changes
- CVE‑2026‑31431 "Copy Fail" allows 4‑byte out‑of‑bounds write in kernel crypto API
- Vulnerability exploits setuid binaries such as /usr/bin/su to gain root
- Cloudflare’s custom kernel builds use LTS 6.12/6.18 with weekly automated builds
- Behavioral detection flagged the exploit within minutes without a signature update
- Initial mitigation in staging rolled back due to a dependency conflict
- bpf‑lsm runtime mitigation drafted and production‑ready by 30 April
- No customer impact; services remained uninterrupted
- Rapid cross‑functional response showcased automated patching and detection