Veeam has issued a warning about a significant vulnerability found in the Linux kernel, which has been assigned a CVSS score of 9.8. This flaw could potentially lead to denial of service or memory corruption, impacting various backup and recovery systems.
Understanding the Vulnerability
On November 6, Veeam released an impact statement concerning a use-after-free vulnerability identified as CVE-2026-98432. This issue affects the TCP/IPv4 connection setup and has prompted Veeam to outline necessary updates for systems at risk.
While there is no current evidence of active exploitation or remote code execution related to this flaw, the potential risks could disrupt backup and restoration operations if affected systems become unavailable.
Impacted Products and Solutions
Products at risk include Veeam Software Appliance 13.1 and Veeam Infrastructure Appliance 13.1. These systems handle crucial roles such as backup proxies, hardened repositories, and Cloud Connect components. Additionally, workers deployed through Veeam’s hypervisor plug-ins will also require kernel updates.
Windows-based installations of Veeam Backup & Replication are also affected due to their reliance on Linux helper appliances for file recovery and cloud restores. The advisory specifies affected versions as 13.1 and 12.3 for these helper appliances.
Update Availability and Recommendations
Veeam has made a patched kernel available for Software Appliance and Infrastructure Appliance 13.1 since November 2. The updated package, 5.14.0-570.60.1+27.2.el9_6_ciq, can be accessed via the Veeam Updater.
Administrators are encouraged to apply these updates through the Veeam Host Management console without delay, as a system restart may be necessary. Updates are checked every 12 hours, with mandatory installations scheduled for the nearest Sunday at 14:00 in the server’s time zone.
For Windows deployments requiring the 13.1 private fix, Backup & Replication version 13.1.2.57 is necessary. Updated installation media for version 13.1.2 includes this fix.
Ensuring Comprehensive Security
Veeam’s advisory indicates that a private fix for version 12.3 will be released soon. Meanwhile, temporary helper appliances will receive updated images upon redeployment. Persistent virtual labs and Microsoft Azure helper appliances need redeployment, and recovery media created prior to this update should be replaced.
Plug-in appliances for AWS, Azure, and Google Cloud will receive Ubuntu kernel updates via Veeam Updater. Administrators should not only apply these updates but also consult the Ubuntu CVE tracker for the latest package status.
Veeam Kasten container images do not include a kernel; however, Kubernetes nodes require vendor checks. Additionally, customer-managed Linux proxies and repositories necessitate distribution updates to ensure no recovery components remain unpatched.
By following these guidelines, organizations can maintain the security of their backup and recovery systems in the face of this critical Linux kernel vulnerability.
