Netatalk CVE-2026-44059

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), enabling Unix-like systems to serve files to macOS clients. The affected component is a privilege toggle routine - code that switches the process between elevated and normal privilege states (e.g., via seteuid/setuid calls) to perform operations requiring temporary elevation. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) describes the root cause: the toggle function is not reentrant, meaning if two execution paths enter it simultaneously, one thread can observe or operate under an elevated privilege state intended only for the other. The CPE string cpe:2.3:a:netatalk:netatalk:*:*:*:*:*:*:*:* confirms all builds of the netatalk application package from 2.2.5 through 4.4.2 are affected, regardless of platform variant.