Veeam Warns Critical 9.8 Linux Kernel Flaw Could Crash Backup Appliances and Disrupt Recovery Operations

Veeam warned that a critical Linux kernel flaw with a CVSS score of 9.8, could cause denial of service or memory corruption across backup and recovery products.

Veeam’s November 6 impact statement identified a Linux kernel use-after-free vulnerability (CVE-2026-98432) in TCP/IPv4 connection setup and outlined update paths for affected systems.

Its security advisory does not report active exploitation or confirm remote code execution. The stated risks could interrupt backup and restore work if an affected appliance becomes unavailable.

Affected products include Veeam Software Appliance 13.1 and Veeam Infrastructure Appliance 13.1. Infrastructure roles include backup proxies, hardened repositories, mount servers, gateways, and Cloud Connect components. Workers deployed through Veeam hypervisor plug-ins also need the updated kernel.

Veeam Warns Critical Linux Kernel Flaw

Windows-based Veeam Backup & Replication installations also require attention because they deploy Linux helper appliances. These support file recovery, virtual labs, and cloud restores. The advisory lists affected helper appliances in versions 13.1 and 12.3, rather than identifying the Windows kernel as vulnerable.

The disclosure follows separate Veeam authorization bypass fixes and earlier Backup & Replication security updates. Those issues have different causes and patch requirements, so administrators should not assume earlier product updates resolve this kernel flaw.

Veeam says a patched kernel has been available for Software Appliance and Infrastructure Appliance 13.1 since November 2. The fixed package is 5.14.0-570.60.1+27.2.el9_6_ciq, delivered through Veeam Updater.

Administrators can install available updates from the Veeam Host Management console without waiting for the automatic schedule. A restart may be required.

The updater checks repositories every 12 hours. Under default settings, mandatory updates install on the nearest Sunday at 14:00 in the backup server’s time zone.

Teams should check update history to confirm installation. Systems using a local repository mirror receive the package only after that mirror synchronizes.

For Windows deployments, the 13.1 private fix requires Backup & Replication 13.1.2.57. Repacked 13.1.2 installation media includes the fix.

Veeam’s November 6 advisory says the private fix for version 12.3 will become available soon. Temporary helper appliances receive updated images when deployed again.

At the same time, persistent virtual labs and Microsoft Azure helper appliances must be redeployed. Replace recovery media created before the update. Hypervisor plug-in workers receive the updated kernel on their next launch.

AWS, Azure, and Google Cloud plug-in appliances receive Ubuntu kernel updates through Veeam Updater. Administrators should install available updates and review the Ubuntu CVE tracker for package status.

Veeam Kasten container images do not include a kernel, but their Kubernetes nodes still need vendor checks. Customer-managed Linux proxies, repositories, and gateways also require distribution updates. Completing these separate checks helps teams avoid leaving recovery components unpatched after updating the main appliance itself.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Veeam Warns Critical 9.8 Linux Kernel Flaw Could Crash Backup Appliances and Disrupt Recovery Operations appeared first on Cyber Security News.