Veeam Warns Critical 9.8 Linux Kernel Flaw Could Crash Backup Appliances and Disrupt Recovery Operations

What happened?

Veeam warned that a critical Linux kernel flaw with a CVSS score of 9.8, could cause denial of service or memory corruption across backup and recovery products. Veeam’s November 6 impact statement identified a Linux kernel use-after-free vulnerability (CVE-2026-98432) in TCP/IPv4 connection setup and outlined update paths for affected systems. Its security advisory does not report active exploitation or confirm remote code execution. The stated risks could interrupt backup and restore work if an affected appliance becomes unavailable.

Key details

• Veeam disclosed a critical Linux kernel use-after-free flaw with a CVSS score of 9.8 that could cause denial of service or memory corruption.
• The vulnerability is tracked as CVE-2026-98432 and resides in TCP/IPv4 connection setup code.
• Veeam Software Appliance 13.1 and Veeam Infrastructure Appliance 13.1 are affected, including backup proxies, hardened repositories, mount servers, gateways, and Cloud Connect components.
• Windows-based Veeam Backup & Replication deployments are also impacted because they use Linux helper appliances for file recovery, virtual labs, and cloud restores.
• A patched kernel package 5.14.0-570.60.1+27.2.el9_6_ciq has been available since November 2 for the 13.1 appliances and is delivered through Veeam Updater.
• For version 12.3 helper appliances, a private fix will be available soon; persistent virtual labs and Azure helper appliances must be redeployed and recovery media replaced.
• Customer-managed Linux proxies, repositories, gateways, and Kubernetes nodes need separate distribution-level kernel updates; Veeam Kasten container images do not include a kernel.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.