Live › vulnerability › CVE-2026-65168
SchedMD fixed this in the 2 Sep 2026 security releases. SchedMD's changelog describes it as a possible slurmstepd crash on invalid step socket requests. The NVIDIA CVE record calls it an attacker-controlled heap buffer overflow (CWE-122), scored CVSS 7.0 with local attack vector, low privileges and high complexity. No exploitation or public PoC found.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Sites running Slurm clusters on 25.05.x before 25.05.9, 25.11.x before 25.11.8 or 26.05.x before 26.05.4. slurmstepd runs on compute nodes, and the CVSS vector is local with low privileges, so the risk is mainly a cluster user or process that can reach the step socket. SchedMD's own text only says crash; code execution is NVIDIA's CVE characterization. Slurm-based services such as AWS ParallelCluster 3.16.0 and earlier and Google Cluster Toolkit blueprints pinned to affected images are listed as affected by this batch of CVEs.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| slurm | vendor | >= 25.05.0, < 25.05.9; >= 25.11.0, < 25.11.8; >= 26.05.0, < 26.05.4 | 25.05.9, 25.11.8, 26.05.4 |
scontrol --version (or slurmstepd -V) on every compute node25.05.0-25.05.8, 25.11.0-25.11.7, 26.05.0-26.05.3 (NVIDIA CNA ranges)25.05.9, 25.11.8 or 26.05.4 (or later) on all nodes running slurmd/slurmstepdEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.
This page as .md · .json · in your agent: get_signal("CVE-2026-65168")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.