v25.11.8

Changes in 25.11.8

• Allow FLEX+MAGNETIC reservations to pick up jobs that extend beyond the reservation's end time.
• Fix slurmctld segfault when QOS-based SUSPEND preemption occurs on a partition with OverSubscribe=YES.
• slurmctld - Fix double-free when a job partition, QOS, or account update request fails for a job in a reservation.
• Fix memory leak in slurmd and slurmstepd when unpacking a job credential.
• Fix possible slurmstepd crash on invalid step socket requests. CVE-2026-65168.
• Fix sbcast shared objects skipping credential verification. CVE-2026-65107.
• Fix possible slurmd crash on invalid sbcast filenames. CVE-2026-65107.
• Fix a slurmstepd stack overflow when a job environment contains an oversized SPANK option variable. CVE-2026-65108.
• Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI container. CVE-2026-65109.
• Fix slurmstepd leaving OCI container spool directories behind when ContainerPath contains a task id pattern. CVE-2026-65109.
• Fix heap over-read when unpacking a malformed forward data RPC in slurmd. CVE-2026-65138.
• Fix a slurmd crash when handling a malformed forward data RPC with a missing socket address. CVE-2026-65138.
• Reject cluster names containing characters that are unsafe to use in an accounting database query. CVE-2026-65139.
• Reject unsafe cluster names on the accounting usage, add and runaway job paths. CVE-2026-65139.
• Reject unsafe cluster names when opening a connection to the slurmdbd. CVE-2026-65139.
• Reject non-numeric id values in accounting database queries. CVE-2026-65139.
• Fix a privilege escalation where an operator could alter Administrator accounts through the accounting database. CVE-2026-65140.
• Fix node count of a job step using arbitrary distribution. CVE-2026-65165.
• Reject a hostlist function in the node list of a job step using arbitrary distribution. CVE-2026-65165.
• Reject a job step whose arbitrary node list disagrees with its node count. CVE-2026-65165.