From 732 bytes to nowhere: shutting down Copy Fail in production

This post details Together AI's rapid response to the Copy Fail (CVE‑2026‑31431) vulnerability. The company implemented a fleet-wide emergency mitigation by disabling the vulnerable `algif_aead` crypto socket interface within hours, preventing local privilege escalation and cross-tenant risks in their multi-tenant AI infrastructure. They quarantined the vulnerable module to prevent re-enabling and are now rolling out vendor-provided kernel patches through a staged validation pipeline. The post highlights lessons learned regarding shared kernels, page cache exploits, and the importance of a default-off approach for niche kernel interfaces, alongside enhanced telemetry for anomaly detection.