SecurityOnlineDo Son
Veeam patches critical Linux kernel flaw in backup appliances
Part of the CVE-2026-98432 story · since 28 Oct
- Wed 28 Oct, 09:02 UTC. The Hacker News, first report. Anthropic AI model chains flaws into browser and OS exploits.
- Wed 28 Oct, 18:01 UTC. SecurityOnline, its first report on the story. Anthropic’s AI research uncovers flaws across major platforms.
- Thu 29 Oct, 17:30 UTC. The Hacker News. Linux TCP flaw rated 9.8 puts Ubuntu and Red Hat at risk.
- Fri 30 Oct, 09:00 UTC. SecurityOnline. Linux kernel flaw could give attackers remote root access.
- Sun 1 Nov, 17:03 UTC. cybersixt, its first report on the story. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default.
- Mon 2 Nov, 15:30 UTC. SANS ISC, its first report on the story. SANS details detection of Linux Multipath TCP vulnerability.
- Mon 2 Nov, 19:30 UTC. The Hacker News. FBI blames North Korean TraderTraitor for $6.43 billion heist.
- Tue 3 Nov, 03:30 UTC. SecurityOnline. Arista patches two flaws that risk remote code execution.
- Tue 3 Nov, 10:30 UTC. SecurityOnline. Ubuntu tests a fix for a Linux kernel flaw rated 9.8.
- Tue 3 Nov, 13:31 UTC. The Hacker News. Red Hat fixes critical Linux TCP flaw enabling remote code execution.
- Thu 5 Nov, 13:30 UTC. SecurityWeek, its first report on the story. Cisco and WatchGuard patch flaws as SonicWall leaves GMS bugs unfixed.
- Fri 6 Nov, 16:31 UTC. SecurityOnline. Veeam patches critical Linux kernel flaw in backup appliances. This article, 12th of 12.
Veeam has issued kernel updates to patch a critical Linux kernel flaw tracked as CVE-2026-98432 across its Software Appliance and related backup tools. The vulnerability, rated CVSS 9.8, is described as a use-after-free in the Linux kernel TCP/IPv4 connection setup that can lead to denial of service or memory corruption. Veeam warns that an attacker can trigger a crash or memory issues by sending crafted packets during connection setup, potentially affecting systems that ship with a built-in Linux kernel. Evidence cited includes the vendor’s KB4966 security advisory and corroborating details in the NVD.
The flaw affects Veeam Software Appliance 13.1, Veeam Infrastructure Appliance 13.1, plug-in workers, Linux helper hosts, and boot media in Veeam Backup & Replication 13.1 and 12.3, with Cloud plug-ins for AWS, Azure and Google Cloud also implicated. In contrast, Veeam Kasten for Kubernetes images do not include a Linux kernel and are considered safe.
Since 2 November 2026, Veeam has released a fixed kernel via Veeam Updater for Software Appliance 13.1; administrators are advised to install updates now (via the Host Management console and Update Install). Windows-based Backup & Replication 13.1.2[.]57 requires the 5 November private fix, with a private fix for 12.3 expected soon. The report notes activity around scanning for vulnerable systems and mentions PoC denial-of-service variants, with more than 450,000 firms reported as using Veeam for backups.
How the story developed
12 articles from 5 outlets since 28 Oct. Still developing; the latest report was 1 hour ago. This was the 12th report, 9 days after the first.
- Wed 28 Oct, 09:02 UTC. The Hacker News, first report. Anthropic AI model chains flaws into browser and OS exploits.
- Wed 28 Oct, 18:01 UTC. SecurityOnline, its first report on the story. Anthropic’s AI research uncovers flaws across major platforms.
- Thu 29 Oct, 17:30 UTC. The Hacker News. Linux TCP flaw rated 9.8 puts Ubuntu and Red Hat at risk.
- Fri 30 Oct, 09:00 UTC. SecurityOnline. Linux kernel flaw could give attackers remote root access.
- Sun 1 Nov, 17:03 UTC. cybersixt, its first report on the story. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default.
- Mon 2 Nov, 15:30 UTC. SANS ISC, its first report on the story. SANS details detection of Linux Multipath TCP vulnerability.
- Mon 2 Nov, 19:30 UTC. The Hacker News. FBI blames North Korean TraderTraitor for $6.43 billion heist.
- Tue 3 Nov, 03:30 UTC. SecurityOnline. Arista patches two flaws that risk remote code execution.
- Tue 3 Nov, 10:30 UTC. SecurityOnline. Ubuntu tests a fix for a Linux kernel flaw rated 9.8.
- Tue 3 Nov, 13:31 UTC. The Hacker News. Red Hat fixes critical Linux TCP flaw enabling remote code execution.
- Thu 5 Nov, 13:30 UTC. SecurityWeek, its first report on the story. Cisco and WatchGuard patch flaws as SonicWall leaves GMS bugs unfixed.
- Fri 6 Nov, 16:31 UTC. SecurityOnline. Veeam patches critical Linux kernel flaw in backup appliances. This article, 12th of 12.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 12 articles as a listHide the list
- Wed 28 OctDay 02
- Anthropic AI model chains flaws into browser and OS exploits09:02 · The Hacker News · First report
- Anthropic’s AI research uncovers flaws across major platforms18:01 · SecurityOnline
- Thu 29 OctDay 11
- Linux TCP flaw rated 9.8 puts Ubuntu and Red Hat at risk17:30 · The Hacker News
- Fri 30 OctDay 21
- Linux kernel flaw could give attackers remote root access09:00 · SecurityOnline
Quiet for 2 days
Sun 1 NovDay 41- CVSS 9.8 Linux flaw lets attackers take root on Go servers by default17:03 · cybersixt · Picked up again
- Mon 2 NovDay 52
- SANS details detection of Linux Multipath TCP vulnerability15:30 · SANS ISC
- FBI blames North Korean TraderTraitor for $6.43 billion heist19:30 · The Hacker News
- Tue 3 NovDay 63
- Arista patches two flaws that risk remote code execution03:30 · SecurityOnline
- Ubuntu tests a fix for a Linux kernel flaw rated 9.810:30 · SecurityOnline
- Red Hat fixes critical Linux TCP flaw enabling remote code execution13:31 · The Hacker News
Quiet for 2 days
Thu 5 NovDay 81- Cisco and WatchGuard patch flaws as SonicWall leaves GMS bugs unfixed13:30 · SecurityWeek
- Fri 6 NovDay 91
- Veeam patches critical Linux kernel flaw in backup appliances16:31 · SecurityOnline · This article, 12th of 12