---
id: "CVE-2026-65168"
kind: "vulnerability"
aliases: ["CVE-2026-65168"]
title: "Slurm: slurmstepd mishandles invalid step socket requests (heap overflow per NVIDIA CVE); fixed in 25.05.9, 25.11.8, 26.05.4"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "slurm", "fixed": ["25.05.9", "25.11.8", "26.05.4"], "affected": ">= 25.05.0, < 25.05.9; >= 25.11.0, < 25.11.8; >= 26.05.0, < 26.05.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["hpc", "infrastructure", "linux", "schedmd", "slurm"]
not_affected_if: []
published_at: "2026-11-03T16:17:36+00:00"
first_seen_at: "2026-11-03T16:21:45+00:00"
updated_at: "2026-11-03T16:25:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65168", "first_seen_at": "2026-11-03T16:21:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T16:25:26+00:00"}]
---

# Slurm: slurmstepd mishandles invalid step socket requests (heap overflow per NVIDIA CVE); fixed in 25.05.9, 25.11.8, 26.05.4

SchedMD fixed this in the 2 Sep 2026 security releases. SchedMD's changelog describes it as a possible slurmstepd crash on invalid step socket requests. The NVIDIA CVE record calls it an attacker-controlled heap buffer overflow (CWE-122), scored CVSS 7.0 with local attack vector, low privileges and high complexity. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:slurm affected >= 25.05.0, < 25.05.9; >= 25.11.0, < 25.11.8; >= 26.05.0, < 26.05.4 fixed 25.05.9, 25.11.8, 26.05.4

## How to check

Run 'scontrol --version' (or 'slurmstepd -V') on every compute node. Affected: 25.05.0-25.05.8, 25.11.0-25.11.7, 26.05.0-26.05.3 (NVIDIA CNA ranges). Anything older than the fixed releases on those branches is exposed. Also check older, unsupported branches, which the sources do not cover.

## Fix

Upgrade to Slurm 25.05.9, 25.11.8 or 26.05.4 (or later) on all nodes running slurmd/slurmstepd. SchedMD notified support customers on 19 Aug and offered patches on request.

## Timeline

- 2026-11-03T16:21:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65168
- 2026-11-03T16:25:26+00:00 analyst — Primary: SchedMD announce 2 Sep 2026 and changelogs list CVE-2026-65168 fixed in 25.05.9/25.11.8/26.05.4. Affected ranges come from NVIDIA CNA via OpenCVE (not the vendor page). SchedMD says 'crash' only; heap overflow/RCE is NVIDIA wording. Auth: CVSS PR:L AV:L, not further documented. No exploitation seen.

## Documents

- [advisory] Slurm 26.05.4, 25.11.8, 25.05.9 available (CVE-2026-65107 et seq) https://lists.schedmd.com/mailman3/hyperkitty/list/slurm-announce@lists.schedmd.com/thread/3YAYJNR6YFN6NLR3S5GVOI6BOTMEZUG5/
- [describes] OpenCVE CVE-2026-65168 (NVIDIA CNA affected ranges) https://app.opencve.io/cve/CVE-2026-65168
- [fix] Slurm 25.05 changelog https://github.com/SchedMD/slurm/blob/slurm-25.11/CHANGELOG/slurm-25.05.md
- [mentions] Google Cloud Security Bulletins: GCP-2026-062: Published: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster  https://docs.cloud.google.com/support/bulletins/index#gcp-2026-062

## From the sources

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_