CVE-2026-91142 Overview
CVE-2026-91142 is an integer overflow vulnerability in the Cockpit server management tool. The flaw resides in the do_lastlog() function, which calculates offsets for lastlog entries on ILP32 (Integer, Long, Pointer 32-bit) builds. A low-privileged authenticated user provisioned with a sufficiently large User ID (UID) can trigger an offset wrap-around. This wrap-around enables unauthorized reads and writes to other users' lastlog records. The consequences include disclosure or modification of login accounting information stored for other accounts on the system. The weakness is categorized as an out-of-bounds write [CWE-787].
Critical Impact
Authenticated local users on 32-bit Cockpit builds can read and tamper with lastlog records belonging to other users, corrupting login accounting data.
Affected Products
- Cockpit (32-bit ILP32 builds)
- Distributions packaging affected Cockpit versions (see Red Hat advisory)
- Systems where users can be provisioned with unusually large UIDs
Discovery Timeline
- 2026-09-18 - CVE-2026-91142 published to the National Vulnerability Database (NVD)
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-91142
Vulnerability Analysis
Cockpit records login accounting information in the lastlog file, where each user's entry is located at a byte offset derived from their UID multiplied by the size of a lastlog record. On ILP32 builds, the integer types used for this arithmetic are 32 bits wide. When a user with a large UID authenticates, the multiplication used to compute the file offset can exceed the maximum representable value and wrap around to a small or negative value.
Because the resulting offset no longer maps to the intended user's slot, subsequent read or write operations land on records belonging to unrelated users. The attacker does not need to escape authentication or escalate privileges: they only need a valid session and a controlled UID assignment. The impact is confined to the confidentiality and integrity of lastlog accounting data.
Root Cause
The root cause is unchecked integer arithmetic in the offset calculation inside do_lastlog(). On 32-bit builds, UID * sizeof(struct lastlog) overflows for large UID values. The overflowed value is then passed to a seek operation without validation, so file I/O proceeds against attacker-influenced offsets.
Attack Vector
Exploitation requires local access and valid credentials, and it depends on administrator provisioning of a user account with a UID large enough to trigger overflow. Once authenticated through Cockpit, normal login accounting flows execute do_lastlog(), which writes to and reads from the miscalculated offset. Complexity is high because the attacker cannot freely choose their own UID; provisioning conditions must align.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Consult the Red Hat CVE-2026-91142 Advisory and Red Hat Bug Report #2479459 for the authoritative technical description.
Detection Methods for CVE-2026-91142
Indicators of Compromise
- Unexpected modifications to /var/log/lastlog timestamps, hostnames, or terminal fields for accounts that did not recently log in.
- Presence of local accounts with unusually large UIDs (for example, values approaching or exceeding 2^31 divided by the lastlog record size) on 32-bit hosts running Cockpit.
- Cockpit session activity from low-privileged accounts followed by anomalous entries in login accounting output such as lastlog or last.
Detection Strategies
- Inventory Cockpit installations and identify which builds are compiled for 32-bit ILP32 architectures, as these are the only builds affected.
- Audit /etc/passwd and directory services for accounts with UIDs large enough to trigger 32-bit multiplication overflow when combined with the lastlog record size.
- Compare lastlog output against authoritative authentication logs from sshd, PAM, and Cockpit to identify inconsistencies suggestive of offset tampering.
Monitoring Recommendations
- Enable file integrity monitoring on /var/log/lastlog and alert on writes not correlated with a recorded authentication event.
- Forward Cockpit, PAM, and system authentication logs into a centralized analytics platform for correlation against lastlog changes.
- Alert whenever new local accounts are created with UIDs outside the organization's standard allocation range.
How to Mitigate CVE-2026-91142
Immediate Actions Required
- Apply vendor updates for Cockpit as they become available; track status through the Red Hat CVE-2026-91142 Advisory.
- Identify and remove or reassign local accounts with abnormally large UIDs on 32-bit hosts running Cockpit.
- Restrict Cockpit access to trusted administrators until the affected builds are patched.
Patch Information
At the time of publication, no fixed version identifier is enumerated in the NVD record. Refer to the Red Hat CVE-2026-91142 Advisory and Red Hat Bug Report #2479459 for downstream package updates and errata tracking.
Workarounds
- Deploy Cockpit only on 64-bit (LP64) builds where the offset arithmetic does not overflow within realistic UID ranges.
- Enforce a UID allocation policy that caps local account UIDs well below the 32-bit overflow threshold for lastlog offsets.
- Disable or uninstall Cockpit on 32-bit systems that cannot be patched or migrated to a 64-bit build.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
