CVE-2026-65165: Out-of-bounds Read
Fix various issues around job steps and node count discrepancies
Other sources
NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated local user with at least low privileges who can submit or control a Slurm job is the relevant threat actor. The attack requires high complexity but does not require user interaction.
What conditions are needed for exploitation?
The attacker needs to deliberately alter the nodelist used with the --distribution=arbitrary option. Successful exploitation could provide access to compute nodes outside that user’s current job allocation.
What is the potential impact?
The reported impact is high confidentiality impact and low availability impact, with no integrity impact specified. This could expose access to compute resources that were not assigned to the attacker’s job.