[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLwkXMNovUz1LE7N7oPDy9v7PuFoGdwSPdGcdpTfsucQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"692af692-a197-42c8-995e-625cb698be57","veeam-appliance-boot-failures-on-amd-epyc-hosts-highlight-update-and-config-risks","334c597f-9faf-4e15-9f39-eba0c29b4684","Veeam Appliance Boot Failures on AMD EPYC Hosts Highlight Update and Config Risks","A compatibility issue between Veeam's Software Appliance and AMD EPYC processors causes kernel panics during boot due to failing FIPS-mode jitterentropy health checks in the Linux kernel — a problem introduced or exposed through automatic updates. This matters because backup and recovery appliances are critical infrastructure; unexpected boot failures can render an organization's entire backup capability unavailable precisely when it's needed most. The incident illustrates the danger of applying automatic updates without validating compatibility across all hardware configurations in the environment. It also highlights that security-hardening features like FIPS mode can introduce unexpected instability if not rigorously tested against diverse hardware. Veeam's recommended workaround — disabling automatic updates — itself introduces a secondary risk of unpatched vulnerabilities remaining in production.","**Immediate actions:**\n- Redeploy affected Veeam Software Appliances to non-AMD EPYC hosts as a temporary measure until a patched version is available.\n- Disable automatic updates on the appliance only as a short-term workaround, while establishing a manual patching schedule to avoid falling behind on security fixes.\n\n**Configuration & Compatibility Controls:**\n- Maintain a detailed hardware inventory mapping all virtual appliances to their underlying host processor architectures to quickly identify blast radius during hardware-specific issues.\n- Test updates in a staging environment that mirrors production hardware diversity — including AMD EPYC, Intel, and ARM variants — before allowing automatic rollout to production.\n- Document and track all FIPS-mode or security-hardening configurations separately, so their interaction with kernel and hardware updates can be validated before deployment.\n\n**Long-term improvements:**\n- Implement a change management process that requires vendor-confirmed hardware compatibility matrices before automatic updates are enabled on critical appliances.\n- Establish health-check monitoring on backup appliances to alert on boot failures or unexpected downtime, ensuring rapid detection of issues introduced by updates.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","OWASP A06:2021 Vulnerable and Outdated Components","DORA Article 9",{"DORA Article 9":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"CIS Control 17: Incident Response Management":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"DORA requires financial entities to ensure ICT resilience including continuity of backup systems; a boot-failing backup appliance directly threatens the operational resilience mandated by this regulation.","SI-2 requires organizations to test software updates before installation; had Veeam updates been tested against AMD EPYC hosts in a controlled manner, the kernel panic would have been caught before impacting production.","Veeam's mitigation guidance — redeploying or disabling updates — constitutes an incident response action; organizations should have pre-defined runbooks for backup appliance failures to execute these steps rapidly without data protection gaps.","This category covers risks from software components behaving unexpectedly; the Linux kernel's jitterentropy implementation interacting poorly with specific CPUs is a component-level compatibility failure with direct availability consequences.","While this issue stems from a compatibility bug rather than a CVE, the guidance to test and stage updates before production deployment directly applies — unvalidated automatic updates introduced the boot failure.","This control requires organizations to manage technical vulnerabilities in a timely and consistent manner, including evaluating the risk of applying — or temporarily withholding — patches when compatibility issues arise.","FIPS mode is a security-hardening requirement often tied to compliance mandates; its failure here shows that enabling cryptographic compliance controls must be validated against the full hardware stack to avoid availability impacts.","published","2026-11-06T16:20:45.569742+00:00","2026-11-06T16:20:45.538+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fveeam-software-appliance-vms-fail-to-boot-on-amd-epyc-hosts\u002F","veeam-warns-of-software-appliance-boot-failures-on-amd-epyc-hosts-ea5950","Veeam warns of Software Appliance boot failures on AMD EPYC hosts",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52],{"slug":44,"name":50,"problem":51},"Automated patch management","Known holes get closed in days, not months.",{"slug":53,"name":54,"problem":55},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]