Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Veeam ships kernel fix for critical Linux flaw CVE-2026-98432

3 sources · 3 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Veeam has a patched kernel for CVE-2026-98432 on appliance 13.1; no exploitation reported, while Ubuntu’s fix remains unfinished.

Veeam warned that critical Linux kernel flaw CVE-2026-98432, a use-after-free in IPv4 TCP code rated 9.8, can cause denial of service or memory corruption in backup products. It affects Software Appliance 13.1 and Infrastructure Appliance 13.1, plus Linux helper appliances used by Windows Backup & Replication 13.1 and 12.3. Patched kernel 5.14.0-570.60.1+27.2.el9_6_ciq has been available since November 2 through Veeam Updater; the advisory does not report active exploitation. Windows deployments also need Backup & Replication 13.1.2.57, according to Cyber Security News. As of November 6, a Hacker News post said Ubuntu still listed the issue as work in progress, with mitigation but no fixed release.

Key facts
  • CVE-2026-98432 is a use-after-free in Linux IPv4 TCP code, CVSS 9.8.
  • Affects Veeam Software and Infrastructure Appliance 13.1 and related components.
  • Windows Backup & Replication 13.1 and 12.3 helper appliances also need updates.
  • Fixed kernel 5.14.0-570.60.1+27.2.el9_6_ciq available since November 2.
  • Veeam’s advisory does not report active exploitation.
  • Ubuntu’s update remained work in progress as of November 6, per Hacker News.
Analyze CVE-2026-98432 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 2, 2026Patched kernel package made available via Veeam Updater · Cyber Security News
  2. Nov 6, 2026Hacker News post says Ubuntu fix still unfinished · Hacker News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsNames affected appliances, fixed package, and no exploitation.
  • BleepingComputerPlaces the flaw in Linux IPv4 TCP networking code.
  • Hacker NewsUbuntu still work in progress; mitigation listed, no fixed release.
CVEs
CVE-2026-98432
Vendors
VeeamUbuntu
Products
Software ApplianceInfrastructure ApplianceBackup & Replication

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Hacker News · securityFirst report

    Ubuntu update delayed for critical CVE-2026-98432

    Ubuntu has left critical CVE-2026-98432 unpatched for nearly a week despite a 9.8 severity rating and available mitigation.

  2. · 6d ago BleepingComputer

    Veeam Software Appliance VMs fail to boot on AMD EPYC hosts

    Veeam Software Appliance VMs running on certain AMD EPYC processors intermittently fail to boot after jitterentropy health test failure in FIPS mode.

  3. · 3d ago Cyber Security News

    Veeam warns critical Linux kernel flaw could crash backup appliances

    Veeam identifies use-after-free in Linux kernel affecting backup appliances; patched kernel available for 13.1 versions.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-98432
Use-after-free in Linux kernel IPv4 TCP options
9.8<1%PoC ×25