Veeam warns critical Linux kernel flaw could crash backup appliances
Original title: Veeam Warns Critical 9.8 Linux Kernel Flaw Could Crash Backup Appliances and Disrupt Recovery Operations
Veeam identifies use-after-free in Linux kernel affecting backup appliances; patched kernel available for 13.1 versions.
Veeam warned of a critical Linux kernel use-after-free vulnerability (CVE-2026-98432) with CVSS score 9.8 that could cause denial of service or memory corruption in backup and recovery products. The flaw impacts Veeam Software Appliance 13.1 and Infrastructure Appliance 13.1, including backup proxies, hardened repositories, mount servers, gateways, Cloud Connect components, and hypervisor plug-in workers. Windows-based Backup & Replication installations deploying Linux helper appliances in versions 13.1 and 12.3 also require attention. A patched kernel package 5.14.0-570.60.1+27.2.el9_6_ciq has been available since November 2 and can be installed via Veeam Updater. The advisory does not report active exploitation.
- Affects Veeam Software Appliance 13.1 and Infrastructure Appliance 13.1
- Fixed package 5.14.0-570.60.1+27.2.el9_6_ciq
- Helper appliances require kernel updates
- Windows deployments need Backup & Replication 13.1.2.57
Impact: denial of service or memory corruption
| Product | Affected | Fixed in |
|---|---|---|
| Veeam Software Appliance | 13.1 | 5.14.0-570.60.1+27.2.el9_6_ciq |
| Veeam Infrastructure Appliance | 13.1 | 5.14.0-570.60.1+27.2.el9_6_ciq |
| Veeam helper appliances | 13.1, 12.3 | updated kernel |
- 1.install Veeam Updater
- 2.restart affected appliances
- 3.check update history
- CVEs
- CVE-2026-98432
- Vendors
- Veeam
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |
From the original article
2 min read at cybersecuritynews.com
Veeam warned that a critical Linux kernel flaw with a CVSS score of 9. 8, could cause denial of service or memory corruption across backup and recovery products. Veeam’s November 6 impact statement identified a Linux kernel use-after-free vulnerability (CVE-2026-98432) in TCP/IPv4 connection setup and outlined update paths for affected systems.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.