Veeam has issued a formal advisory regarding a persistent boot failure affecting its Linux-based Software Appliance virtual machines. The issue specifically impacts appliances running on host hardware equipped with certain AMD EPYC processors, including the 7262, 7302, and 7F72 models. This technical fault manifests as a kernel panic during the early stages of the boot process, preventing the appliance from initializing successfully.
The root cause of the failure has been identified as a conflict between the Linux kernel’s security configuration and the underlying processor architecture. To maintain compliance with rigorous security frameworks, the Veeam Software Appliance operates in FIPS mode, which requires the kernel to perform integrated health and cryptographic checks during startup. Specifically, the jitterentropy health test fails intermittently on the affected AMD EPYC hardware, triggering a kernel panic that halts the system.
According to the company, this issue is present in version 13.1 and later of the Software Appliance. Users encountering this error will see a specific kernel panic message indicating that the jitterentropy initialization failed because the host did not meet the required compliance standards. This behavior can occur following any reboot, including those triggered by automated kernel updates.
Veeam has confirmed that a standard guest operating system restart is insufficient to resolve the panic. Instead, administrators must power off the virtual machine entirely and then power it back on to attempt a successful boot. Once the appliance has bypassed the initial check and reached an operational state, the company notes that the core functions of the Veeam Backup & Replication software remain stable and are not further impacted by the underlying hardware conflict.
For organizations unable to migrate their appliances to hosts with different processor architectures, Veeam recommends disabling automatic updates. By manually installing updates, administrators can closely monitor the virtual machine during the subsequent reboot process to ensure it recovers from any potential kernel panic.
In addition to the boot failure issue, Veeam has addressed a separate, unrelated security concern involving a critical vulnerability in the Linux kernel. This flaw, tracked as CVE-2026-98432, resides in the IPv4 TCP networking code and could potentially allow an unauthenticated remote attacker to execute commands with root privileges on servers that utilize Multipath TCP listeners.
Veeam has confirmed that this vulnerability affects several of its components. The company is currently in the process of distributing patches to mitigate this risk, delivering the updated kernel either through the standard Veeam Updater or as a private fix for specific environments.
These developments impact a significant portion of the enterprise market, as Veeam’s product suite is currently utilized by over 550,000 customers. The company’s user base includes a substantial majority of both the Global 2,000 and Fortune 500 firms, making the stability and security of these Linux-based appliances a priority for large-scale infrastructure management.
