Veeam has published a product-by-product impact statement for CVE-2026-98432, a critical Linux kernel vulnerability that affects several of its backup appliances, helper systems and cloud plug-ins. The company said on November 6 that components containing a Linux kernel remain exposed until they receive the relevant kernel update or private fix.
Tracked as CVE-2026-98432, the flaw is a use-after-free in the Linux kernel’s TCP/IPv4 connection setup and carries a CVSS score of 9.8. Veeam says it can cause denial of service or memory corruption, while Red Hat’s security bulletin says a remote, unauthenticated attacker could potentially use the race condition to achieve code execution. The vulnerability also prompted fixed kernels for Red Hat Enterprise Linux 8, 9 and 10, as detailed in Abijita’s report on the RHEL patches.
Veeam lists Software Appliance 13.1 and Infrastructure Appliance 13.1 among the affected products, including infrastructure roles such as backup proxies, repositories, hardened repositories, mount servers, gateways and WAN accelerators. The advisory also covers Linux-based helper appliances used by Veeam Backup & Replication 13.1 on Windows and version 12.3, workers deployed by hypervisor plug-ins, Veeam Cloud Connect components, recovery media for Veeam Agent for Linux, and appliances used by its AWS, Microsoft Azure and Google Cloud plug-ins.
The company said Veeam Kasten for Kubernetes is not affected because its container images do not include a Linux kernel. Customer-managed Linux servers that host Veeam components are also outside the scope of Veeam’s product fixes and remain subject to the relevant Linux distribution advisories.
Veeam said a fixed kernel has been available in its repository since November 2 for Software Appliance and Infrastructure Appliance 13.1. The update uses kernel version 5.14.0-570.60.1+27.2.el9_6_ciq and is delivered through Veeam Updater. Windows-based Veeam Backup & Replication 13.1 installations need the private fix after installing version 13.1.2.57, while the private fix for version 12.3 was still listed as forthcoming in the November 6 advisory. Recovery media created before the relevant update must also be replaced.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
