CVE-2026-65168
Description
A flaw was found in Slurm. A heap-based buffer overflow exists in the socket handling code of the slurmstepd service. A local attacker with low privileges could exploit this vulnerability by sending crafted data to the service socket, corrupting memory. This could allow the attacker to achieve arbitrary code execution, escalate privileges, or cause a denial of service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to restrict local access to slurmstepd service sockets to prevent unprivileged users from interacting with the socket handling interface: upgrade to the fixed Slurm builds, which apply the documented input check, closing crafted data sent to slurmstepd service socket. Until patched, this is a concern on Linux systems running slurmstepd with local low-privileged user access, so Restrict local user access to hosts running slurmstepd and audit or restrict permissions on the slurmstepd service socket. As a compensating measure, Enable ASLR to randomize memory layout and impede reliable address prediction and control flow hijacking, Compile slurmstepd with Full RELRO and PIE to protect the Global Offset Table and enforce position-independent execution, Implement Control Flow Integrity or Shadow Call Stack to validate indirect call targets and prevent execution redirection via corrupted heap pointers, Enable FORTIFY_SOURCE to detect runtime buffer overflows during socket message processing, and Enforce SELinux in enforcing mode to confine the slurmstepd domain and block unauthorized privilege escalation. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap-based buffer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
