Cloudflare Blocks Copy‑Fail Linux Flaw Using bpf‑LSM

Cloudflare’s response to the Copy Fail Linux vulnerability began the moment it was publicly disclosed on 29 April 2026, with a rapid assessment of fleet exposure and mitigation options. The team established that there was no impact to Cloudflare’s environment, no customer data at risk, and no services disrupted, even as they validated that existing behavioural detections could identify the exploit pattern.

To mitigate the vulnerability, engineers pursued a two‑track approach: a non‑rebooting workaround using the bpf‑lsm tool to deny AF_ALG binds for non‑whitelisted binaries, and a patched kernel backport for the long‑term fix, while carefully sequencing deployments across the fleet. They confirmed detection coverage within minutes during internal validation and launched a staged rollout that included visibility checks via a Prometheus ebpf exporter before enforcement.

In parallel, removal of the algif_aead module was considered but rejected due to potential impact on other software, so the team relied on bpf‑lsm and staged patching to protect hundreds of thousands of servers, with no reported customer impact at any point.