Veeam Software Appliance VMs Fail to Boot on AMD EPYC Hosts Due to FIPS‑Mode Jitterentropy Check
What Happened — Veeam disclosed that its Linux‑based Software Appliance virtual machines (used to run Veeam Backup & Replication) intermittently experience kernel panics and fail to boot on hosts equipped with certain AMD EPYC processors (e.g., 7262, 7302, 7F72). The failure is triggered by a jitterentropy health test that runs in FIPS mode during early boot; when the test does not pass, the kernel aborts with the message “jitterentropy: Initialization failed with host not compliant with requirements: 9”. The issue affects Veeam Software Appliance version 13.1 and later and is tied to the Linux kernel bundled with the appliance. Veeam recommends redeploying the appliance to a host with a different CPU, or, if that is not possible, disabling automatic updates and manually applying patches while monitoring reboots. A simple power‑off/power‑on does not recover the VM; a full restart of the guest OS is required.
Why It Matters for Trust & Control Assurance — The incident highlights the need for rigorous configuration‑management controls that verify software compatibility across hardware platforms.
Who Is Affected — Enterprises that run Veeam Backup & Replication via the Software Appliance, spanning most verticals that rely on data‑protection solutions (e.g., finance, healthcare, SaaS providers).
Recommended Actions —
- Verify CPU compatibility before deploying the Veeam Software Appliance.
- Document and maintain a baseline configuration that includes approved host processor families.
- Enable continuous monitoring of boot logs for kernel panic events and retain evidence for audit purposes.
- If impacted, follow Veeam’s mitigation steps: redeploy to a supported processor or disable automatic updates and apply patches manually.
Technical Notes — The failure stems from a jitterentropy health‑check in the Linux kernel running in FIPS mode; no CVE is assigned to this specific incompatibility. The same advisory also references a separate critical Linux kernel vulnerability (CVE‑2026‑98432) affecting other Veeam components. Source: BleepingComputer