Have you previously killed any sessions of user
Depending on operating system and the way it handles updates to the
wtmp files, killing a user session with
kill -9 may cause its session record in the
utmp file to be left in a "session is active" state.
When a new session using the same (pseudo)TTY device is initialized, the code that writes the
utmp entry sees that the slot for that TTY device is already used by an active entry, and uses the next free slot.
Then, commands like
finger have a sensible expectation that only one user at a time can be using a TTY device, so once they find one entry for a particular TTY device, they won't look for any others... and so they display the wrong, stale entry instead of the one that is actually current.
utmpdump command can be used to dump the binary
utmp file into text format, for seeing if this kind of utmp corruption has happened. Then you can edit the text version to remove the stale entries, and use
utmpdump -r to reconstruct a new binary
utmp file with the corrupted entries removed.
Or, if you can have all the users log out for a moment, just have everyone else log out, truncate the utmp file to zero size, logout and log back in.
# echo "Everyone logout now, please" | wall
# > /var/run/utmp
And in the future, please use
kill -HUP to end shell sessions instead of
kill -9 or
kill -KILL to avoid this problem in the first place.