CybersecurityVulnerability Management

Veeam Disrupts Software Appliance Boot on AMD EPYC Hosts

Analyst 207||Source: BleepingComputer
Server equipment in a data center with a terminal display in the foreground.

"A Veeam Software Appliance (Linux-based Veeam Backup & Replication) virtual machine running on a host with an AMD EPYC processor intermittently fails to boot after a reboot, including a reboot that follows an update that installs a new kernel," Veeam said in its advisory.

Veeam advisory: affected appliances, versions, and error text

Veeam warned that its pre-configured, Linux-based Software Appliance virtual machines — designed to let administrators run the Veeam Backup & Replication suite without manually installing dependencies — can fail to boot on hosts that use certain AMD EPYC processors. The company said the problem affects Veeam Software Appliance version 13.1 and later and originates in the specific Linux kernel version used by those appliances.

Impacted systems exhibit a kernel panic during early boot. Veeam reports administrators are seeing the precise error: "Kernel panic - not syncing: jitterentropy: Initialization failed with host not compliant with requirements: 9." The company named several AMD EPYC processors in which the jitterentropy test intermittently fails, including AMD EPYC 7262, 7302, and 7F72.

How the FIPS-mode jitterentropy check stops boot

Veeam explained the appliance's kernel runs integrated health and cryptographic checks in FIPS mode during early boot to comply with corporate and government security frameworks. One of those checks is a jitterentropy health test. When that test intermittently fails on the affected AMD EPYC hosts, the kernel stops the boot process with a kernel panic and the virtual machine crashes.

The company said the failure comes from the Linux kernel version used by the appliance rather than from Veeam application logic. Because the test runs early in the kernel boot sequence, the appliance cannot complete a normal startup when the jitterentropy initialization is reported as non-compliant by the kernel.

Mitigation steps Veeam recommends for IT administrators

  • Redeploy the appliance to a Linux host with a different, unaffected processor when possible. Veeam lists redeployment to an unaffected host as the primary mitigation.
  • If redeployment is not possible, disable automatic updates for the appliance and perform updates manually while monitoring the virtual machine as it reboots. This avoids an unattended kernel update that could trip the jitterentropy check.
  • If a kernel panic occurs, power off the virtual machine and power it on again. Veeam warned that a simple restart of the guest operating system does not recover the virtual machine; only a full power cycle restores operation.
  • Veeam added that once the appliance has booted successfully after a power cycle, no further errors are expected and the operation of Veeam Backup & Replication itself is not affected.

Related kernel vulnerability (CVE-2026-98432) and patch distribution

Separately, Veeam said some of its products are affected by a critical Linux kernel vulnerability identified as CVE-2026-98432. The company described the flaw as located in the IPv4 TCP networking code and said it allows remote unauthenticated attackers to execute commands as root on servers running Multipath TCP (MPTCP) listeners.

Veeam reported it has fixed the CVE-2026-98432 flaw for some impacted components and is pushing the patched kernel to affected systems either as a private fix or through the Veeam Updater. That same kernel distribution effort is the mechanism Veeam is using to address the broader set of kernel-related problems it has identified in its appliance fleet.

What this means for IT administrators, enterprises using AMD EPYC hosts, and Veeam's large customer base

  • IT administrators: Expect to change update practices for affected appliances. If you cannot move the VM to a non-EPYC host, disable automatic updates and monitor manual kernel updates carefully to avoid an unattended boot failure.
  • Enterprises running AMD EPYC hosts: Systems using AMD EPYC 7262, 7302, 7F72 or other similarly affected processors should be prioritized for review. Redeploying the appliance to different hardware is Veeam's recommended fix when feasible.
  • Large Veeam customers: Veeam noted its products are used by more than 550,000 customers, including 74% of the Global 2,000 and 82% of the Fortune 500, underlining that this is an issue with potential impact at scale for organizations that rely on the Software Appliance form factor.

Veeam has provided clear short-term mitigations — redeployment, manual updates, and a specific recovery step when a kernel panic occurs — and is distributing a patched kernel for a separate critical CVE. The situation leaves administrators balancing security compliance (FIPS-mode checks) against availability: the kernel's FIPS-mode jitterentropy test enforces cryptographic health, but on certain AMD EPYC hosts that enforcement prevents affected appliances from booting. For now, careful update control or hardware relocation are the practical options until patched kernels are deployed.

Original report

Cloud ComputingEmerging ThreatsLinuxVirtual MachineBackup And ReplicationVeeam SoftwareAMD EPYCSoftware ApplianceInfrastructure Issues
Related Intelligence

Continue Reading

Server room interior with rows of racks, management console, and cables, lit by daylight from a large window.

Misconfigured Virtualization Environments Expose Administrative Access Risks

Attackers can easily gain administrative access to virtualization environments through misconfigured monitoring servers and reused credentials, putting entire estates at risk of ransomware attacks. Even without a complex VM escape, hackers can take advantage of exposed credentials and overprivileged monitoring identities to wreak havoc.

Analyst 207
Devices showing Claude AI System and browser extensions on a cluttered home office desk.

Browser Extensions Expose Flaw in Claude AI System

Researchers at Forever Security have uncovered a vulnerability in the Claude AI System, demonstrating a live proof-of-concept where a malicious browser extension could trick Claude Desktop into running system-level commands on a user's computer. This flaw was cleverly exploited using the Claude Dispatch feature, highlighting a potential security risk.

Analyst 207
Windows laptop on a modern office desk with blurred screen and scattered papers nearby.

Microsoft Paint Flaw Gets Fix, Bypasses Windows Update

A critical flaw in Microsoft Paint, known as CVE-2026-83844, has been patched, but the fix is only available through the Microsoft Store, leaving some users and devices vulnerable. This remote code execution vulnerability could allow attackers to run malicious code on your system over a network, no login or interaction required.

Analyst 207
Clean workstation with laptop and monitor displaying code, surrounded by notes.

Chainguard Disrupts Vulnerability Disclosure with AI-Driven Flood of Findings

Imagine uncovering over 40,000 vulnerabilities, with 42% being critical or high-priority, across 500 projects - and swiftly resolving them with over 2,000 patches produced. Starting September 28, Chainguard will begin publicly disclosing these findings, kicking off with a batch of 50 quietly fixed vulnerabilities.

Analyst 207