{"id":"CVE-2026-65108","kind":"vulnerability","aliases":["CVE-2026-65108"],"related":[],"title":"NVIDIA Slurm: heap buffer overflow in slurmstepd lets attackers run as root","description":"NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.","summary":"NVIDIA Slurm's slurmstepd process has a heap-based buffer overflow that an attacker can control. Because slurmstepd runs with root permissions, a successful attack can give the attacker root-level control of the affected host.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpc","infrastructure","linux","self-hosted","slurm"],"not_affected_if":["no-slurm-deployment"],"how_to_check":"- Check whether Slurm is installed and which version is running, for example with `slurmd -V` or `sinfo --version` (unknown if the sources name a specific check)\n- Confirm whether slurmstepd is running on your compute nodes","fix":null,"status":"open","published_at":"2026-11-03T16:17:35+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","triaged_at":"2026-11-03T16:24:07+00:00","updated_at":"2026-11-03T16:24:07+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T16:24:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"NVIDIA Slurm: heap buffer overflow in slurmstepd lets attackers run as root","impact":"high","summary":"NVIDIA Slurm's slurmstepd process has a heap-based buffer overflow that an attacker can control. Because slurmstepd runs with root permissions, a successful attack can give the attacker root-level control of the affected host.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["slurm","hpc","linux","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains root on cluster compute nodes running slurmstepd","analyst_note":"Find affected Slurm version ranges, the fixed release, and the trigger condition in the NVD entry or NVIDIA's Slurm security bulletin.","how_to_check":"- Check whether Slurm is installed and which version is running, for example with `slurmd -V` or `sinfo --version` (unknown if the sources name a specific check)\n- Confirm whether slurmstepd is running on your compute nodes","plain_action":"","needs_analyst":true,"not_affected_if":["no-slurm-deployment"],"who_is_affected":"Teams that run NVIDIA Slurm for job scheduling on compute clusters, where slurmstepd runs as root on the nodes. The sources do not say which Slurm versions are affected or what conditions trigger the overflow.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4150,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-65108':15A,18A 'affect':62B 'attack':9A,40B,51B,55B,69C 'attacker-control':68C 'base':35B,73C 'buffer':4A,36B,74C 'contain':66C 'control':42B,59B,70C 'cve':13A,16A 'give':53B 'heap':3A,34B,72C 'heap-bas':33B,71C 'host':24B,63B 'hpc':19B 'infrastructur':20B 'let':8A 'level':58B 'linux':21B 'nvidia':1A,26B,64C 'overflow':5A,37B,75C 'permiss':48B,87C 'process':30B,79C 'root':12A,47B,57B,86C 'root-level':56B 'run':10A,45B,84C 'self':23B 'self-host':22B 'slurm':2A,25B,27B,65C 'slurmstepd':7A,29B,44B,78C,82C 'success':50B","nicknames":[],"mitigations":[],"who_affected":"Teams that run NVIDIA Slurm for job scheduling on compute clusters, where slurmstepd runs as root on the nodes. The sources do not say which Slurm versions are affected or what conditions trigger the overflow.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hpc","infrastructure","linux","medium","selfhosted","slurm"],"campaign_type":null,"first_public_at":"2026-10-28T15:19:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@nvidia.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65108","severity":null,"published_at":"2026-11-03T16:17:35+00:00","modified_at":"2026-11-03T16:17:35+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","fetched_at":"2026-11-03T16:21:45+00:00","note":null}],"documents":[{"id":27284,"url":"https://docs.cloud.google.com/support/bulletins/index#gcp-2026-062","title":"Google Cloud Security Bulletins: GCP-2026-062: Published: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster ","kind":"vendor","source":"vendor","publisher":null,"text":"GCP-2026-062\n\nPublished: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster Toolkit blueprints that reference specific image versions. These vulnerabilities affect the slurmstepd daemon, RPC request handling, and the accounting database. What should I do? For instructions and more details, see the Cluster Toolkit security bulletin . High CVE-2026-65107 CVE-2026-65108 CVE-2026-65109 CVE-2026-65138 CVE-2026-65139 CVE-2026-65140 CVE-2026-65165 CVE-2026-65168","published_at":"2026-10-28T15:19:22+00:00","relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}