On April 29, 2026, researchers disclosed CVE-2026-31431—nicknamed “Copy Fail”—a local privilege escalation bug in the Linux kernel’s AF_ALG crypto interface. It lets an unprivileged process splice page cache references into a crypto AEAD operation, then trigger an out-of-bounds write of four bytes into any file’s cached pages. The default exploit targets /usr/bin/su by poisoning its text segment in cache and then running execve to gain root. Upstream fixed it by undoing the 2017 in-place crypto optimization in commit a664bf3d603d. Cloudflare’s security and engineering teams kicked off simultaneous workstreams the moment the CVE hit public feeds. They mapped which LTS kernel builds—mostly 6.12, some 6.18—were at risk, confirmed that existing behavioral detection flagged the attack chain within minutes, and scoured 48 hours of logs for any pre-disclosure exploitation. Meanwhile, kernel engineers sketched a runtime mitigation and pushed the fixed kernel through their four-week Edge Reboot Release pipeline. Throughout the response, no services went down, and no customer data was exposed. The incident showed how Cloudflare’s weekly automated internal kernel builds, staged testing, and rolling reboots across 330 cities let them absorb a critical Linux flaw without disruption. Their detection system, built around anomaly spotting rather than CVE signatures, caught the exploit pattern right away—before anyone wrote a Copy Fail–specific rule.