Veeam has issued a high-severity warning this week about a critical Linux kernel flaw—CVE-2026-98432—with a CVSS score of 9.8. The vulnerability, a use-after-free bug in the TCP/IPv4 connection setup, could lead to denial of service or memory corruption within its backup and recovery products. Though no remote code execution has been confirmed yet, the risk of disruption to backup appliances and recovery operations is very real.
Affected Products & Components
The flaw impacts multiple Veeam systems, including the Software Appliance 13.1 and Infrastructure Appliance 13.1. Core roles such as backup proxies, hardened repositories, mount servers, gateways, and Cloud Connect components are vulnerable. Additionally, components deployed via hypervisor plug-ins—like worker nodes—are affected and require kernel updates.
Even Windows-based Veeam Backup & Replication setups are not immune. These use Linux “helper” appliances for things like file recovery, virtual labs, and cloud restores. In versions 13.1 and 12.3, those helper appliances are exposed—not the Windows kernel itself.
Patches, Mitigations & What Needs Doing
A patched kernel (5.14.0-570.60.1+27.2.el9_6_ciq) has been released for the 13.1 Software and Infrastructure Appliances as of November 2. Administrators are encouraged to apply updates via the Veeam Updater, and a reboot may be necessary to fully remediate the issue.
Updates are on an automatic schedule, triggering every 12 hours by default. Mandatory fixes are rolled out each Sunday at 14:00 local time, but teams can manually install available updates from the Host Management console immediately. For Windows users, version 13.1.2.57 includes the fix. A private patch for version 12.3 is coming soon.
Other systems also need attention: helper appliances utilized in Azure and AWS, Ubuntu-based kernel updates, and virtual lab media created before the patch must be replaced. Kubernetes nodes tied to Kasten container images—though not running a vulnerable kernel themselves—still need vendor verification. Local repository mirrors should also be synchronized to receive the fixed package.
Veeam’s advisory also urges operators to check update history and deployment status across all components. Persistent virtual lab environments and helper appliances in public cloud settings should be redeployed post-patch. Failing to do so could leave recovery capabilities exposed even after core appliances are updated.
What this means: Kernel vulnerabilities like CVE-2026-98432 strike at the heart of backup infrastructure. For many organizations, these appliances are last lines of defense—when data loss or downtime loom. Acting fast matters. Ensuring timely patching, verifying all helper and cloud-side components, and replacing old media are essential steps to avoid being caught flat footed by what could otherwise be a catastrophic exploit.
