{"id":"ASB-A-522376559", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-55275", "A-522376559"], "details":"In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/hardware/nxp/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e"], "severity":"Critical", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"36253413422107638751724557129333465245", "length":2774}, "id":"ASB-A-522376559-12bce048", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_TmlThread"}}, {"deprecated":false, "digest":{"function_hash":"260895799017144006521655962357376492512", "length":213}, "id":"ASB-A-522376559-144c42d9", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}, {"deprecated":false, "digest":{"function_hash":"260895799017144006521655962357376492512", "length":213}, "id":"ASB-A-522376559-1fb5b364", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}, {"deprecated":false, "digest":{"function_hash":"250206736237646727872729314262012289095", "length":325}, "id":"ASB-A-522376559-3227efcc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e", "target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}, {"deprecated":false, "digest":{"line_hashes":["137729986726834220153758843001342381987", "34690655052730806104815974042755490950", "314867958065263402798590851395676189680", "99843953941826109628306304468982929747", "74823944509944921546644574926987282827", "194859648925305615769019290086493649946", "111665456638357796684350143075108643334", "285467037410426999516727484614337059866", "172925267726085532505909612717220357447", "130024807833773936668370085431107765687", "59827619814627849540325519557903963717", "135236032354579975889995765401222591229", "103795969636534287899232264288749651503", "41376380536892647265902818426369456488", "22163985884780806184353380514138073853", "209292399499066018765389665177809443180", "107223334400844073881200238028961841886", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-62e25f91", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc"}}, {"deprecated":false, "digest":{"line_hashes":["144722185872458352175695309995412161175", "266398905134325890997895978440588504970", "115336630579501178796342975358812085604", "253957693696326673168358941375493745845", "234558396294514808921723259972505558560", "39415392936972581800397717124168780807", "327196665478299826929701536419826278121", "188048062670159779650524256944277490948", "39702670087852557057074381422778856982", "130024807833773936668370085431107765687", "59827619814627849540325519557903963717", "135236032354579975889995765401222591229", "103795969636534287899232264288749651503", "41376380536892647265902818426369456488", "22163985884780806184353380514138073853", "209292399499066018765389665177809443180", "107223334400844073881200238028961841886", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-6e940db1", "match_only_versions":["17-qpr2-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc"}}, {"deprecated":false, "digest":{"line_hashes":["94819916502523114305836174566238729646", "147954369963902169108221791516930027988", "77235648048634745239559180971320411516", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-8525f208", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e", "target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"114290257722219193526046978192912268280", "length":2830}, "id":"ASB-A-522376559-aa7e7e0d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_TmlThread"}}]}}, {"package":{"name":"platform/hardware/nxp/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5"], "severity":"Critical", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"114290257722219193526046978192912268280", "length":2830}, "id":"ASB-A-522376559-0fec8399", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_TmlThread"}}, {"deprecated":false, "digest":{"line_hashes":["137729986726834220153758843001342381987", "34690655052730806104815974042755490950", "314867958065263402798590851395676189680", "99843953941826109628306304468982929747", "74823944509944921546644574926987282827", "194859648925305615769019290086493649946", "111665456638357796684350143075108643334", "285467037410426999516727484614337059866", "172925267726085532505909612717220357447", "130024807833773936668370085431107765687", "59827619814627849540325519557903963717", "135236032354579975889995765401222591229", "103795969636534287899232264288749651503", "41376380536892647265902818426369456488", "22163985884780806184353380514138073853", "209292399499066018765389665177809443180", "107223334400844073881200238028961841886", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-7ae2c764", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc"}}, {"deprecated":false, "digest":{"line_hashes":["144722185872458352175695309995412161175", "266398905134325890997895978440588504970", "115336630579501178796342975358812085604", "253957693696326673168358941375493745845", "234558396294514808921723259972505558560", "39415392936972581800397717124168780807", "327196665478299826929701536419826278121", "188048062670159779650524256944277490948", "39702670087852557057074381422778856982", "130024807833773936668370085431107765687", "59827619814627849540325519557903963717", "135236032354579975889995765401222591229", "103795969636534287899232264288749651503", "41376380536892647265902818426369456488", "22163985884780806184353380514138073853", "209292399499066018765389665177809443180", "107223334400844073881200238028961841886", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-9688315e", "match_only_versions":["16"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"260895799017144006521655962357376492512", "length":213}, "id":"ASB-A-522376559-b7d26dab", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}, {"deprecated":false, "digest":{"function_hash":"36253413422107638751724557129333465245", "length":2774}, "id":"ASB-A-522376559-bb5292fb", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_TmlThread"}}, {"deprecated":false, "digest":{"function_hash":"260895799017144006521655962357376492512", "length":213}, "id":"ASB-A-522376559-e9cec518", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}]}}, {"package":{"name":"platform/hardware/nxp/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d"], "severity":"Critical", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"114290257722219193526046978192912268280", "length":2830}, "id":"ASB-A-522376559-12cc917a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_TmlThread"}}, {"deprecated":false, "digest":{"function_hash":"250206736237646727872729314262012289095", "length":325}, "id":"ASB-A-522376559-15dc38be", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d", "target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}, {"deprecated":false, "digest":{"line_hashes":["144722185872458352175695309995412161175", "266398905134325890997895978440588504970", "115336630579501178796342975358812085604", "253957693696326673168358941375493745845", "234558396294514808921723259972505558560", "39415392936972581800397717124168780807", "327196665478299826929701536419826278121", "188048062670159779650524256944277490948", "39702670087852557057074381422778856982", "130024807833773936668370085431107765687", "59827619814627849540325519557903963717", "135236032354579975889995765401222591229", "103795969636534287899232264288749651503", "41376380536892647265902818426369456488", "22163985884780806184353380514138073853", "209292399499066018765389665177809443180", "107223334400844073881200238028961841886", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-40d7a98e", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"36253413422107638751724557129333465245", "length":2774}, "id":"ASB-A-522376559-5566a31c", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_TmlThread"}}, {"deprecated":false, "digest":{"line_hashes":["94819916502523114305836174566238729646", "147954369963902169108221791516930027988", "77235648048634745239559180971320411516", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-918e15c8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d", "target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"260895799017144006521655962357376492512", "length":213}, "id":"ASB-A-522376559-bc0ae88c", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}, {"deprecated":false, "digest":{"line_hashes":["137729986726834220153758843001342381987", "34690655052730806104815974042755490950", "314867958065263402798590851395676189680", "99843953941826109628306304468982929747", "74823944509944921546644574926987282827", "194859648925305615769019290086493649946", "111665456638357796684350143075108643334", "285467037410426999516727484614337059866", "172925267726085532505909612717220357447", "130024807833773936668370085431107765687", "59827619814627849540325519557903963717", "135236032354579975889995765401222591229", "103795969636534287899232264288749651503", "41376380536892647265902818426369456488", "22163985884780806184353380514138073853", "209292399499066018765389665177809443180", "107223334400844073881200238028961841886", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-c8ef44eb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"260895799017144006521655962357376492512", "length":213}, "id":"ASB-A-522376559-d644093b", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}]}}, {"package":{"name":"platform/hardware/nxp/nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18"], "severity":"Critical", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"250206736237646727872729314262012289095", "length":325}, "id":"ASB-A-522376559-5ae7a643", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18", "target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}, {"deprecated":false, "digest":{"function_hash":"260895799017144006521655962357376492512", "length":213}, "id":"ASB-A-522376559-65a4f653", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}, {"deprecated":false, "digest":{"line_hashes":["94819916502523114305836174566238729646", "147954369963902169108221791516930027988", "77235648048634745239559180971320411516", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-79cebbbb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18", "target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"260895799017144006521655962357376492512", "length":213}, "id":"ASB-A-522376559-81c0be2c", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_ReadAbort"}}, {"deprecated":false, "digest":{"line_hashes":["137729986726834220153758843001342381987", "34690655052730806104815974042755490950", "314867958065263402798590851395676189680", "99843953941826109628306304468982929747", "74823944509944921546644574926987282827", "194859648925305615769019290086493649946", "111665456638357796684350143075108643334", "285467037410426999516727484614337059866", "172925267726085532505909612717220357447", "130024807833773936668370085431107765687", "59827619814627849540325519557903963717", "135236032354579975889995765401222591229", "103795969636534287899232264288749651503", "41376380536892647265902818426369456488", "22163985884780806184353380514138073853", "209292399499066018765389665177809443180", "107223334400844073881200238028961841886", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-b44adfbb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc"}}, {"deprecated":false, "digest":{"function_hash":"36253413422107638751724557129333465245", "length":2774}, "id":"ASB-A-522376559-bf454f99", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_TmlThread"}}, {"deprecated":false, "digest":{"function_hash":"114290257722219193526046978192912268280", "length":2830}, "id":"ASB-A-522376559-d0c43389", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18", "target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc", "function":"phTmlNfc_TmlThread"}}, {"deprecated":false, "digest":{"line_hashes":["144722185872458352175695309995412161175", "266398905134325890997895978440588504970", "115336630579501178796342975358812085604", "253957693696326673168358941375493745845", "234558396294514808921723259972505558560", "39415392936972581800397717124168780807", "327196665478299826929701536419826278121", "188048062670159779650524256944277490948", "39702670087852557057074381422778856982", "130024807833773936668370085431107765687", "59827619814627849540325519557903963717", "135236032354579975889995765401222591229", "103795969636534287899232264288749651503", "41376380536892647265902818426369456488", "22163985884780806184353380514138073853", "209292399499066018765389665177809443180", "107223334400844073881200238028961841886", "302532930595921609684880952382230647687"], "threshold":0.9}, "id":"ASB-A-522376559-eaab66b9", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18", "target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}