{"id":"CVE-2026-65168","kind":"vulnerability","aliases":["CVE-2026-65168"],"related":[],"title":"Slurm: slurmstepd mishandles invalid step socket requests (heap overflow per NVIDIA CVE); fixed in 25.05.9, 25.11.8, 26.05.4","description":"NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.","summary":"SchedMD fixed this in the 2 Sep 2026 security releases. SchedMD's changelog describes it as a possible slurmstepd crash on invalid step socket requests. The NVIDIA CVE record calls it an attacker-controlled heap buffer overflow (CWE-122), scored CVSS 7.0 with local attack vector, low privileges and high complexity. No exploitation or public PoC found.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"slurm","fixed":["25.05.9","25.11.8","26.05.4"],"affected":">= 25.05.0, < 25.05.9; >= 25.11.0, < 25.11.8; >= 26.05.0, < 26.05.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["hpc","infrastructure","linux","schedmd","slurm"],"not_affected_if":[],"how_to_check":"Run 'scontrol --version' (or 'slurmstepd -V') on every compute node. Affected: 25.05.0-25.05.8, 25.11.0-25.11.7, 26.05.0-26.05.3 (NVIDIA CNA ranges). Anything older than the fixed releases on those branches is exposed. Also check older, unsupported branches, which the sources do not cover.","fix":"Upgrade to Slurm 25.05.9, 25.11.8 or 26.05.4 (or later) on all nodes running slurmd/slurmstepd. SchedMD notified support customers on 19 Aug and offered patches on request.","status":"open","published_at":"2026-11-03T16:17:36+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","triaged_at":"2026-11-03T16:23:53+00:00","updated_at":"2026-11-03T16:25:26+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-03T16:23:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"NVIDIA Slurm: heap buffer overflow in slurmstepd socket handling lets attackers run code","impact":"high","summary":"NVIDIA Slurm, the cluster job scheduler, has a heap-based buffer overflow in the slurmstepd socket handling code. The sources say the overflow is attacker-controlled, which can lead to code execution on the node.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["slurm","hpc","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker may execute code on cluster compute nodes","analyst_note":"Find affected Slurm versions, the fixed release and whether the socket path needs authentication, from NVIDIA's advisory via the NVD entry.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run Slurm clusters for compute jobs are the ones exposed, since slurmstepd runs on compute nodes to launch and supervise jobs. The sources do not name affected versions or the exact socket configuration needed to reach the bug. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":4139,"output_tokens":466,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Slurm versions, the fixed release and whether the socket path needs authentication, from NVIDIA's advisory via the NVD entry.","search":"'-122':69B '-2026':19A,22A '-65168':20A,23A '2':35B '2026':37B '25.05.9':15A '25.11.8':16A '26.05.4':17A '7.0':72B 'attack':63B,75B,93C 'attacker-control':62B,92C 'base':97C 'buffer':66B,98C 'call':59B 'changelog':42B 'code':105C 'complex':81B 'contain':90C 'control':64B,94C 'crash':49B 'cve':12A,18A,21A,57B 'cvss':71B 'cwe':68B 'describ':43B 'exploit':83B 'fix':13A,31B 'found':87B 'handl':104C 'heap':8A,65B,96C 'heap-bas':95C 'high':80B 'hpc':25B 'infrastructur':26B 'invalid':4A,51B 'linux':27B 'local':74B 'low':77B 'mishandl':3A 'nvidia':11A,56B,88C 'overflow':9A,67B,99C 'per':10A 'poc':86B 'possibl':47B 'privileg':78B 'public':85B 'record':58B 'releas':39B 'request':7A,54B 'schedmd':28B,30B,40B 'score':70B 'secur':38B 'sep':36B 'slurm':1A,24A,29B,89C 'slurmstepd':2A,48B,102C 'socket':6A,53B,103C 'step':5A,52B 'vector':76B","nicknames":[],"mitigations":[],"who_affected":"Sites running Slurm clusters on 25.05.x before 25.05.9, 25.11.x before 25.11.8 or 26.05.x before 26.05.4. slurmstepd runs on compute nodes, and the CVSS vector is local with low privileges, so the risk is mainly a cluster user or process that can reach the step socket. SchedMD's own text only says crash; code execution is NVIDIA's CVE characterization. Slurm-based services such as AWS ParallelCluster 3.16.0 and earlier and Google Cluster Toolkit blueprints pinned to affected images are listed as affected by this batch of CVEs.","tier":"B","verified":{"fix":{"at":"2026-11-03T16:25:26Z","by":"analyst","doc":"https://github.com/SchedMD/slurm/blob/slurm-25.11/CHANGELOG/slurm-25.05.md","run_id":1505},"who_affected":{"at":"2026-11-03T16:25:26Z","by":"analyst","doc":"https://github.com/SchedMD/slurm/blob/slurm-25.11/CHANGELOG/slurm-25.05.md","run_id":1505}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["slurm"],"ptokens":["slurm"],"labels":["high","hpc","infrastructure","linux","schedmd","slurm"],"campaign_type":null,"first_public_at":"2026-10-28T15:19:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@nvidia.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65168","severity":null,"published_at":"2026-11-03T16:17:36+00:00","modified_at":"2026-11-03T16:17:36+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","fetched_at":"2026-11-03T16:21:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-65168:1505","url":null,"severity":null,"published_at":"2026-11-03T16:25:26+00:00","modified_at":"2026-11-03T16:25:26+00:00","first_seen_at":"2026-11-03T16:25:26+00:00","fetched_at":"2026-11-03T16:25:26+00:00","note":"Primary: SchedMD announce 2 Sep 2026 and changelogs list CVE-2026-65168 fixed in 25.05.9/25.11.8/26.05.4. Affected ranges come from NVIDIA CNA via OpenCVE (not the vendor page). SchedMD says 'crash' only; heap overflow/RCE is NVIDIA wording. Auth: CVSS PR:L AV:L, not further documented. No exploitation seen."}],"documents":[{"id":27284,"url":"https://docs.cloud.google.com/support/bulletins/index#gcp-2026-062","title":"Google Cloud Security Bulletins: GCP-2026-062: Published: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster ","kind":"vendor","source":"vendor","publisher":null,"text":"GCP-2026-062\n\nPublished: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster Toolkit blueprints that reference specific image versions. These vulnerabilities affect the slurmstepd daemon, RPC request handling, and the accounting database. What should I do? For instructions and more details, see the Cluster Toolkit security bulletin . High CVE-2026-65107 CVE-2026-65108 CVE-2026-65109 CVE-2026-65138 CVE-2026-65139 CVE-2026-65140 CVE-2026-65165 CVE-2026-65168","published_at":"2026-10-28T15:19:22+00:00","relation":"mentions","confidence":null,"note":null},{"id":58874,"url":"https://lists.schedmd.com/mailman3/hyperkitty/list/slurm-announce@lists.schedmd.com/thread/3YAYJNR6YFN6NLR3S5GVOI6BOTMEZUG5/","title":"Slurm 26.05.4, 25.11.8, 25.05.9 available (CVE-2026-65107 et seq)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":58876,"url":"https://github.com/SchedMD/slurm/blob/slurm-25.11/CHANGELOG/slurm-25.05.md","title":"Slurm 25.05 changelog","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":58877,"url":"https://app.opencve.io/cve/CVE-2026-65168","title":"OpenCVE CVE-2026-65168 (NVIDIA CNA affected ranges)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}