Cloudflare’s writeup on how they handled “Copy Fail” (CVE-2026-31431) is a rare vulnerability story where the blue team looks good.
The bug is an out-of-bounds write in the kernel’s algif_aead / authencesn AEAD wrapper that spills four bytes past the output buffer, which is enough to poison the page cache backing setuid binaries like /usr/bin/su and hand an unprivileged process a root shell.
Back in May the bug came with a 732-byte Python exploit that worked across Ubuntu, Amazon Linux, RHEL and SUSE.
Cloudflare’s behavioral detection flagged the exploit within minutes with no signature update, a 48-hour fleet-wide hunt turned up nothing, and they shipped a two-stage eBPF and bpf-lsm mitigation blocking unauthorized AF_ALG socket binds while the patched kernel rolled out.
Turns out four bytes is still plenty when they land in the right place.
