Veeam has published a new security advisory regarding CVE-2026-98432, a critical vulnerability affecting the Linux kernel’s TCP/IPv4 connection setup process.
With a CVSS score of 9.8 (Critical), this vulnerability deserves the attention of backup administrators and IT professionals responsible for protecting enterprise infrastructure.
According to Veeam Knowledge Base article KB4966, several Veeam components that include a Linux kernel are affected. The good news is that security updates and fixes are available for several product versions.
What is CVE-2026-98432?
CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel.
This type of vulnerability occurs when a program continues to access memory after it has been released. Depending on the circumstances, exploitation can potentially lead to:
- Denial of Service (DoS)
- Memory corruption
- Potential disruption of system operations
Because Veeam relies on Linux-based appliances for several backup infrastructure roles, it is important to identify the affected components and apply the appropriate security updates.
Which Veeam products are affected?
According to the official Veeam advisory, the following components are impacted:
- Veeam Software Appliance 13.1
- Veeam Infrastructure Appliance 13.1, including backup proxies, repositories, hardened repositories, mount servers, gateway servers, WAN accelerators, and other infrastructure roles.
- Veeam Cloud Connect Linux-based cloud gateways and WAN accelerators.
- Linux-based helper appliances deployed by Veeam Backup & Replication 13.1 and 12.3.
- Veeam Recovery Media for Veeam Agent for Linux, depending on the version and when the media was created.
- Veeam Plug-ins for AWS, Microsoft Azure, and Google Cloud.
It is important to note that Veeam Kasten for Kubernetes is not directly affected, because its container images do not include a Linux kernel. The Kubernetes node operating system remains the responsibility of the customer or platform provider.
How to apply the security fix
The remediation depends on the Veeam product and deployment type.
Veeam Software Appliance and Veeam Infrastructure Appliance 13.1
The patched kernel is available through Veeam Updater.
Administrators can manually install the update by following these steps:
- Log in to the Veeam Host Management Console.
- Navigate to Updates.
- Click Check for updates.
- Select the available updates.
- Click Install Updates Now.
- Restart the appliance if required.
The patched kernel version is:
5.14.0-570.60.1+27.2.el9_6_ciq
Veeam Backup & Replication 13.1 on Windows
For Windows-based Veeam Backup & Replication installations using Linux helper appliances, a private fix is available.
Before installing the private fix, ensure that Veeam Backup & Replication version 13.1.2.57 is installed.
The private fix can be downloaded from the official KB4966 article.
Veeam Backup & Replication 12.3
At the time of publication of the advisory, the private fix for Linux-based helper appliances was still pending.
Administrators should monitor the official Veeam KB for further updates.
Other Linux-based components
For Veeam public cloud appliances and hypervisor workers, the appropriate updates are delivered through Veeam Updater or automatically when workers are launched.
Administrators should also review any existing helper appliances that require redeployment, particularly Virtual Labs and helper appliances deployed in Microsoft Azure.
My recommendations for backup administrators
From a data protection perspective, backup infrastructure should be treated as a critical security asset.
I recommend the following actions:
- Review your Veeam infrastructure and identify all Linux-based appliances.
- Verify the installed versions and kernel patch levels.
- Check Veeam Updater and install all applicable security updates.
- Verify the update history after installation.
- Redeploy persistent helper appliances where required.
- Review the official advisory regularly for new information.
Keeping backup infrastructure secure is essential to maintaining data availability and resilience, especially in environments exposed to ransomware and other cyber threats.
Conclusion
CVE-2026-98432 highlights the importance of maintaining an up-to-date backup infrastructure.
Even when the primary backup server is running Windows, Linux-based components may still be part of the overall Veeam deployment and require attention.
Taking the time to review your environment and apply the appropriate fixes can help reduce security risks and improve the resilience of your data protection strategy.
Official Reference
Veeam Knowledge Base – KB4966:
https://www.veeam.com/kb4966