This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-91142 →

DEBIAN-CVE-2026-91142

A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of logi...

Original description

The description as published by the source.

A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 cockpit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 cockpit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 cockpit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"368-1"}]}]

References

advisory security-tracker.debian.org