A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify… (CVE-2026-44059)

CVE-2026-44059 describes a race condition in the privilege toggle mechanism in Netatalk versions 2.2.5 through 4.4.2. This race condition can be exploited by a local attacker to gain limited information disclosure, perform limited data modification, or induce minor service disruption. The vulnerability affects multiple Ubuntu package versions of Netatalk as listed. The CVSS 3.1 base score is 4.5, reflecting medium severity with attack vector local, high attack complexity, low privileges required, no user interaction, unchanged scope, and impacts on confidentiality, integrity, and availability at a limited level.

The vulnerability allows a local attacker to gain limited information, modify limited data, or cause minor disruption to the Netatalk service. The impact is limited in scope and severity, with no indication of full system compromise or remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict local access to trusted users only to mitigate risk.