A four-byte out-of-bounds write buried in the Linux kernel's cryptographic subsystem — present since a 2017 performance optimization — let unprivileged attackers corrupt the in-memory copy of any setuid binary and escalate to root.
The flaw, tracked as CVE-2026-31431 and publicly named "Copy Fail," exploits the algif_aead module, which handles authenticated encryption requests from userspace over Linux's AF_ALG socket interface. A 2017 in-place optimization chained destination and source page cache references without enforcing output boundaries, leaving the kernel's authencesn wrapper free to write 4 bytes past the intended region on every recvmsg() call. By routing a target file's page cache pages into the crypto scatterlist via splice(), an attacker controls which file is dirtied, at which offset, and with what bytes — the obvious mark is /usr/bin/su, a setuid-root binary present on essentially every Linux distribution, after which a plain execve() runs injected shellcode as root. The upstream fix is a single commit reverting the 2017 change.
Cloudflare, which runs custom kernel builds across infrastructure in 330 cities, says its fleet was already on patched LTS versions by April 29 when the CVE went public — typical for how LTS maintenance works, since fixes land in stable branches weeks before a CVE number is assigned. More interesting is what happened during an internal validation run: the company's behavioral detection flagged the full exploit chain, from the crypto subsystem through the privilege escalation binary, within minutes, with no signature update and no new rule written beforehand.
The "we were already patched" part is reassuring but not the point — most organizations don't have automated kernel pipelines or fleet-wide anomaly detection, which means the window between upstream fix and applied patch is exactly when they're sitting on a local-privilege-escalation flaw that dates back nine years.