CVE-2026-65108 in Slurm
Summary
by MITRE • 11/03/2026
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified within NVIDIA's Slurm Workload Manager represents a critical security flaw located specifically within the slurmstepd daemon, which operates under elevated privileges as the root user. This heap-based buffer overflow condition arises when the process processes input that has been manipulated or controlled by an attacker. The core technical issue stems from insufficient bounds checking during memory allocation and data handling operations within the step execution phase of Slurm. When a job step is initiated, slurmstepd allocates specific regions in the heap to manage task-related data structures. If an adversary can influence the size parameters or content of these inputs through maliciously crafted job submissions or API calls, they may trigger an overflow condition where more data is written into the allocated buffer than it was designed to hold. This overwriting extends beyond the boundaries of the intended memory segment, corrupting adjacent heap metadata and potentially other critical application state information stored in contiguous memory locations.
The operational impact of this vulnerability is severe due to the execution context of the slurmstepd process. Because Slurm manages resource allocation across high-performance computing clusters, its daemons typically run with root privileges to ensure they can manage hardware resources, isolate processes, and enforce quotas effectively. An attacker who successfully exploits this heap-based buffer overflow gains the ability to execute arbitrary code within the context of the root user on the affected compute node or controller. This level of access allows for complete compromise of the underlying system, enabling the installation of persistent backdoors, exfiltration of sensitive data stored locally on cluster nodes, and lateral movement across the network infrastructure. Furthermore, since Slurm is often central to scientific research and enterprise computing environments containing proprietary intellectual property, such a breach could lead to significant financial loss and reputational damage for organizations relying on these clusters for critical operations.
From a classification perspective, this vulnerability aligns with Common Weakness Enumeration (CWE) ID 120, which describes Buffer Copy without Checking Size of Input, specifically manifesting as CWE-122: Heap-based Buffer Overflow. In the context of the MITRE ATT&CK framework, exploitation of this flaw would likely facilitate initial access and privilege escalation techniques. An attacker might leverage tools or scripts to craft malicious job descriptions that trigger the overflow during the parsing phase, leading to code execution that aligns with T1068: Exploitation for Privilege Escalation. The ability to run arbitrary commands as root effectively grants control over the entire node, allowing further reconnaissance and persistence mechanisms consistent with post-exploitation behaviors outlined in the framework.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. NVIDIA has released patches that address this specific heap overflow by implementing stricter input validation and bounds checking within the slurmstepd codebase. Administrators should prioritize applying these updates to all Slurm-managed nodes immediately upon availability. In addition to patching, organizations should enforce strict access controls on job submission interfaces, ensuring that only authorized users can submit jobs with complex or large resource requirements. Implementing network segmentation to isolate compute clusters from less trusted networks reduces the attack surface available for remote exploitation attempts. Furthermore, deploying intrusion detection systems capable of monitoring for anomalous memory usage patterns or unexpected privilege escalations within Slurm processes can provide early warning indicators of attempted exploits. Regular security audits and code reviews focused on C/C++ memory management practices are also recommended to prevent similar vulnerabilities in future software updates.