Veeam flags AMD EPYC boot failures in versions 13.1 and later

By Daniel Okafor

Veeam Software Appliance version 13.1 and later can intermittently fail to boot on some AMD EPYC hosts, including EPYC 7262, 7302, and 7F72 processors.

Veeam’s Wednesday advisory traced the failure to an early-boot FIPS-mode jitterentropy health test. Certain AMD EPYC processors intermittently fail that test, which stops the Linux kernel and produces a panic.

Veeam describes the appliance as a preconfigured, Linux-based VM for Veeam Backup & Replication. It lets administrators run the backup suite on Linux devices without manually installing dependencies or configuring the software.

What exactly is failing?

To support corporate and government security frameworks, the appliance kernel runs integrated health and cryptographic checks during early boot. Veeam identifies the jitterentropy health test in FIPS mode as the failing checkpoint.

Veeam said: “A Veeam Software Appliance (Linux-based Veeam Backup & Replication) virtual machine running on a host with an AMD EPYC processor intermittently fails to boot after a reboot, including a reboot that follows an update that installs a new kernel.”

The advisory says the failure can follow a reboot or an update that installs a new kernel. Affected systems can display Kernel panic - not syncing: jitterentropy: Initialization failed with host not compliant with requirements: 9.

Veeam said the known issue originates in the Linux kernel version used by the appliance. It affects Software Appliance 13.1 and later. The advisory did not quantify affected installations or incidents.

What workarounds can administrators use?

• Change the host processor. Veeam recommends redeploying the appliance to a Linux host with a different processor. The advisory names no alternative processor models and gives no migration procedure, expected effort, or remediation cost.
• Control updates manually. If redeployment is impossible, Veeam advises disabling automatic appliance updates and installing updates manually. Administrators should monitor the VM while it reboots.

Veeam presents both routes as mitigations, not as a stated kernel patch. That transfers update control and restart observation to the customer.

Veeam’s recovery instruction is blunt: “If the kernel panic occurs, power off the virtual machine and power it on again. A restart of the guest operating system does not recover the virtual machine.”

After a successful boot, Veeam expects no further errors from this issue and says Veeam Backup & Replication operation remains unaffected. That assurance applies only after recovery, not to the failed boot itself. The advisory provides no recurrence rate, retry limit, or recovery-time estimate.

What did Veeam patch separately?

Earlier that day, Veeam said the flaw in CVE-2026-98432 affects some of its products. The critical Linux kernel vulnerability sits in IPv4 TCP networking code and allows remote unauthenticated attackers to execute commands as root on servers running Multipath TCP listeners.

Veeam has patched some affected components and is pushing the patched kernel to affected systems as a private fix or through Veeam Updater. The company does not identify every affected component or give a rollout completion date.

The two disclosures require different responses. The EPYC defect triggers appliance boot failures, while CVE-2026-98432 creates a remote root-execution path on MPTCP listeners. Neither issue shares the same trigger or mitigation.

How large is Veeam’s footprint?

Veeam says its products serve more than 550,000 customers, including 74% of Global 2,000 firms and 82% of Fortune 500 companies across its installed base.

The figures establish market reach, not exposure to either defect. Veeam provides no affected-customer count, affected-host count, outage duration, or aggregate remediation cost for either issue. It also discloses no customer credit or compensation.

Enterprise visibility remains broad, while incident impact remains unquantified. The installed base gives Veeam substantial distribution. It does not establish how many organizations run the affected configuration.

What else did Veeam promote alongside the advisories?

Veeam also promoted a 14-day, read-only scan of Microsoft 365 or Google Workspace. Its Adaptive Security AI agents analyze email intent, context, and behavior to identify phishing, business email compromise, and invoice fraud during those scans.

Veeam calls the scan free and says it requires no MX changes. It claims the assessment can uncover threats existing defenses miss. The promotional copy gives no accuracy, detection-rate, or customer-performance figures. The offer provides no measured efficacy baseline.