HomeOctober 2026 patch cycleCVE-2026-98432 Veeam appliances: Linux kernel TCP fix
Call: Known issueCategory: Enterprisefrom 2026-10
CVE-2026-98432 Veeam appliances: Linux kernel TCP fix
Part of October 2026 patch cycle
- Vendor
- Veeam
- Products
- Veeam Software Appliance 13.1, Veeam Infrastructure Appliance 13.1, Veeam Backup & Replication 13.1, Veeam Backup & Replication 12.3, Veeam Agent for Linux, and Veeam cloud plug-in appliances
- Published
- Status
- Open
Call: Known issue. CVE-2026-98432 is a critical (CVSS 9.8) use-after-free in the Linux kernel’s IPv4 TCP connection setup. It can lead to denial of service or memory corruption; researchers have shown remote code execution against some MPTCP listeners. As of Nov 6 it is not reported as actively exploited and is not in CISA KEV. On Nov 6, Veeam published KB4966 with product-by-product impact and fixes for every Veeam component that ships a Linux kernel.
What breaks: Nothing in the Veeam product UI. The risk is the unpatched kernel inside Veeam appliances, helpers, workers, and recovery media. Customer-managed Linux proxies and repositories are on you and your distro vendor, not Veeam.
Who’s hit (per Veeam):
- Software Appliance and Infrastructure Appliance 13.1 (many proxy/repo/Cloud Connect roles): update via Veeam Updater. Fixed kernel
5.14.0-570.60.1+27.2.el9_6_ciqhas been in the Veeam repo since Nov 2. - Hypervisor plug-in workers: pick up the kernel the next time they launch.
- Windows-based Backup & Replication 13.1 Linux helper appliances: private fix
VeeamBackup&Replication_13.1.2.57_20261105_PrivateFix.exe(needs 13.1.2.57 first). New ISO builds include it. - Backup & Replication 12.3 helpers and recovery media: private fix “soon.”
- AWS / Azure / Google Cloud plug-in appliances: Veeam Updater (Ubuntu kernels).
- Kasten for Kubernetes: not affected (no kernel in the containers).
- Veeam Recovery Media for Agent for Linux 13.1: replace media created before the update.
What to do:
- On appliances: Check for updates in Host Management and install now if you do not want to wait for the default Sunday auto-update window. A restart may be required.
- On Windows B&R 13.1: install the Nov 5 private fix, then redeploy lingering virtual labs and Azure helper appliances so they pick up the new proxy/helper image.
- On customer Linux servers that host Veeam roles: follow Ubuntu/RHEL (or your distro) advisories for CVE-2026-98432 and reboot into the fixed kernel.
- If your Software Appliance also sits on AMD EPYC, read KB4960 before you reboot into a new kernel: intermittent early-boot panics need a power cycle, not a soft reboot.
Sources: Veeam KB4966 (opens in a new tab), Akamai research (opens in a new tab), AWS bulletin (opens in a new tab).