This vulnerability involves an integer overflow in the offset calculation for lastlog entries in the do_lastlog() function of Cockpit on ILP32 (32-bit Integer, Long, Pointer) builds. A low-privileged authenticated user with a specially provisioned large UID can cause the offset to wrap around, leading to out-of-bounds reads and writes of lastlog records belonging to other users. This can result in unauthorized disclosure or modification of login accounting data. The issue does not enable code execution or privilege escalation. The vulnerability is tracked as CWE-787 (Out-of-bounds Write).

The vulnerability allows a low-privileged authenticated user to read and modify lastlog records of other users due to an integer overflow causing offset wraparound. This impacts confidentiality and integrity of login accounting information but does not affect availability or allow privilege escalation or code execution. The attack requires local access and has high complexity, limiting exploitability.

Red Hat has published an advisory for CVE-2026-91142. The advisory does not explicitly state that a fix is currently available or deployed. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-91142 for current remediation guidance. Until a fix is available, restrict access to systems to trusted users and monitor for suspicious activity involving lastlog records. No specific mitigations are provided by the vendor advisory beyond awaiting an official fix.