An integer overflow in Cockpit's do_lastlog() function affects the offset calculation for lastlog entries on ILP32 (32-bit Integer, Long, Pointer) builds. A low-privileged authenticated user with a specially crafted large UID can cause the offset to wrap around, leading to out-of-bounds reads and writes of lastlog records belonging to other users. This results in unauthorized disclosure and modification of login accounting information. The flaw does not enable code execution or privilege escalation. The vulnerability is tracked as CWE-787 (Out-of-bounds Write) and has a CVSS v3.1 base score of 3.6 with local attack vector, high attack complexity, low privileges required, and no user interaction.

The vulnerability allows a local authenticated user with a large UID to perform unauthorized reads and writes to other users' lastlog records, potentially disclosing or altering sensitive login accounting information. It does not lead to code execution, privilege escalation, or denial of service. The impact is limited to confidentiality and integrity of lastlog data with low severity.

Red Hat has published an advisory for this vulnerability. The advisory does not explicitly state that a fix is currently available, nor does it provide patch links. Therefore, patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-91142 for current remediation guidance. Exploitation requires a low-privileged authenticated user with a large UID on ILP32 builds, which limits exposure. No additional mitigations are specified by the vendor.