Slurm wlm: [Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI containe, Fix slurmstepd leaving OCI container spool… (CVE-2026-65109)

The vulnerability CVE-2026-65109 in slurmstepd involves two related issues: first, slurmstepd removes files outside the intended container spool directory when cleaning up OCI containers, potentially affecting files beyond the container scope; second, slurmstepd leaves OCI container spool directories behind when the ContainerPath includes a task ID pattern, causing residual data to persist. These behaviors could lead to unintended file deletions and leftover directories, impacting system cleanliness and potentially causing operational issues. The affected versions are explicitly listed and include various releases from 20.11.4 through 26.05.4 in specific package builds.

The impact includes unintended removal of files outside the container spool directory, which could lead to loss of data or disruption of unrelated files. Additionally, leftover spool directories may consume disk space and complicate container management. There is no indication of active exploitation in the wild. The severity is medium, reflecting moderate risk due to file removal outside intended boundaries and residual directory presence.

No patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, users should monitor container cleanup processes and manually verify spool directory states to mitigate potential issues.