Veeam has warned that some Software Appliance virtual machines fail to boot on hosts with AMD EPYC processors. The issue can end in a kernel panic during early boot when the appliance runs a FIPS-mode jitterentropy check, and it affects Software Appliance version 13.1 and later.
How the appliance starts up
The Veeam Software Appliance is a pre-configured, Linux-based virtual machine that lets administrators run the Veeam Backup & Replication backup suite on Linux devices without manually installing dependencies or setting up the software. Its underlying Linux kernel performs integrated health and cryptographic checks during early boot so it can meet corporate and government security frameworks. The boot problem appears in that stage, before the appliance comes up fully.
Veeam said the failure happens after a reboot, including a reboot that follows an update installing a new kernel. It said the Linux kernel used by the appliance runs a jitterentropy health test in FIPS mode during early boot, and that test intermittently fails on certain AMD EPYC processors. The processors named by the company are AMD EPYC 7262, 7302, and 7F72.
Errors seen on affected systems
Veeam said users are seeing the kernel panic message “Kernel panic – not syncing: jitterentropy: Initialization failed with host not compliant with requirements: 9” on impacted systems. The company described this as a known issue that comes from the Linux kernel version used by the Software Appliance.
Mitigation and recovery
Veeam told IT administrators to redeploy the appliance to a Linux host with a different processor. If redeployment on an unaffected processor is not possible, administrators are advised to disable automatic updates for the appliance and install updates manually while watching the VM as it reboots. If the kernel panic happens, Veeam said to power off the virtual machine and power it on again. A restart of the guest operating system does not recover the virtual machine, and once the appliance boots successfully, no further errors are expected. Veeam also said the operation of Veeam Backup & Replication is not affected.
A separate Linux kernel flaw
Earlier today, Veeam said some of its products are affected by a critical Linux kernel vulnerability, CVE-2026-98432, in the IPv4 TCP networking code. That flaw allows remote unauthenticated attackers to execute commands as root on servers running Multipath TCP listeners. Veeam has fixed the flaw for some impacted components and is pushing the patched kernel to affected systems either as a private fix or through the Veeam Updater.
Veeam said its products are used by more than 550,000 customers, including 74% of Global 2,000 firms and 82% of Fortune 500 companies.
Licensed under CC BY-ND 4.0 International