{"id":"ASB-A-522376559","details":"In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-522376559","CVE-2026-55275"],"modified":"2026-11-02T17:11:19.086400575Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/hardware/nxp/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc","function":"phTmlNfc_TmlThread"},"deprecated":false,"digest":{"length":2774,"function_hash":"36253413422107638751724557129333465245"},"id":"ASB-A-522376559-12bce048","match_only_versions":["17-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e","target":{"function":"phTmlNfc_ReadAbort","file":"pn8x/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"function_hash":"260895799017144006521655962357376492512","length":213},"id":"ASB-A-522376559-144c42d9","match_only_versions":["17-qpr2-next"]},{"id":"ASB-A-522376559-1fb5b364","match_only_versions":["17-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e","target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc","function":"phTmlNfc_ReadAbort"},"deprecated":false,"digest":{"length":213,"function_hash":"260895799017144006521655962357376492512"}},{"id":"ASB-A-522376559-3227efcc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e","target":{"function":"phTmlNfc_ReadAbort","file":"snxxx/halimpl_v2/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"length":325,"function_hash":"250206736237646727872729314262012289095"}},{"source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e","target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"line_hashes":["137729986726834220153758843001342381987","34690655052730806104815974042755490950","314867958065263402798590851395676189680","99843953941826109628306304468982929747","74823944509944921546644574926987282827","194859648925305615769019290086493649946","111665456638357796684350143075108643334","285467037410426999516727484614337059866","172925267726085532505909612717220357447","130024807833773936668370085431107765687","59827619814627849540325519557903963717","135236032354579975889995765401222591229","103795969636534287899232264288749651503","41376380536892647265902818426369456488","22163985884780806184353380514138073853","209292399499066018765389665177809443180","107223334400844073881200238028961841886","302532930595921609684880952382230647687"],"threshold":0.9},"id":"ASB-A-522376559-62e25f91","signature_type":"Line","signature_version":"v1"},{"target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"line_hashes":["144722185872458352175695309995412161175","266398905134325890997895978440588504970","115336630579501178796342975358812085604","253957693696326673168358941375493745845","234558396294514808921723259972505558560","39415392936972581800397717124168780807","327196665478299826929701536419826278121","188048062670159779650524256944277490948","39702670087852557057074381422778856982","130024807833773936668370085431107765687","59827619814627849540325519557903963717","135236032354579975889995765401222591229","103795969636534287899232264288749651503","41376380536892647265902818426369456488","22163985884780806184353380514138073853","209292399499066018765389665177809443180","107223334400844073881200238028961841886","302532930595921609684880952382230647687"],"threshold":0.9},"id":"ASB-A-522376559-6e940db1","match_only_versions":["17-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e"},{"id":"ASB-A-522376559-8525f208","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e","target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["94819916502523114305836174566238729646","147954369963902169108221791516930027988","77235648048634745239559180971320411516","302532930595921609684880952382230647687"]}},{"digest":{"function_hash":"114290257722219193526046978192912268280","length":2830},"id":"ASB-A-522376559-aa7e7e0d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e","target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc","function":"phTmlNfc_TmlThread"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e"],"severity":"Critical","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522376559.json"}},{"package":{"name":"platform/hardware/nxp/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5","target":{"function":"phTmlNfc_TmlThread","file":"snxxx/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"length":2830,"function_hash":"114290257722219193526046978192912268280"},"id":"ASB-A-522376559-0fec8399","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5","target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"line_hashes":["137729986726834220153758843001342381987","34690655052730806104815974042755490950","314867958065263402798590851395676189680","99843953941826109628306304468982929747","74823944509944921546644574926987282827","194859648925305615769019290086493649946","111665456638357796684350143075108643334","285467037410426999516727484614337059866","172925267726085532505909612717220357447","130024807833773936668370085431107765687","59827619814627849540325519557903963717","135236032354579975889995765401222591229","103795969636534287899232264288749651503","41376380536892647265902818426369456488","22163985884780806184353380514138073853","209292399499066018765389665177809443180","107223334400844073881200238028961841886","302532930595921609684880952382230647687"],"threshold":0.9},"id":"ASB-A-522376559-7ae2c764","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5","target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"line_hashes":["144722185872458352175695309995412161175","266398905134325890997895978440588504970","115336630579501178796342975358812085604","253957693696326673168358941375493745845","234558396294514808921723259972505558560","39415392936972581800397717124168780807","327196665478299826929701536419826278121","188048062670159779650524256944277490948","39702670087852557057074381422778856982","130024807833773936668370085431107765687","59827619814627849540325519557903963717","135236032354579975889995765401222591229","103795969636534287899232264288749651503","41376380536892647265902818426369456488","22163985884780806184353380514138073853","209292399499066018765389665177809443180","107223334400844073881200238028961841886","302532930595921609684880952382230647687"],"threshold":0.9},"id":"ASB-A-522376559-9688315e","match_only_versions":["16"],"signature_type":"Line"},{"deprecated":false,"digest":{"length":213,"function_hash":"260895799017144006521655962357376492512"},"id":"ASB-A-522376559-b7d26dab","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5","target":{"function":"phTmlNfc_ReadAbort","file":"pn8x/halimpl/tml/phTmlNfc.cc"}},{"match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5","target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc","function":"phTmlNfc_TmlThread"},"deprecated":false,"digest":{"length":2774,"function_hash":"36253413422107638751724557129333465245"},"id":"ASB-A-522376559-bb5292fb"},{"deprecated":false,"digest":{"function_hash":"260895799017144006521655962357376492512","length":213},"id":"ASB-A-522376559-e9cec518","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5","target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc","function":"phTmlNfc_ReadAbort"}}],"fixes":["https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5"],"severity":"Critical","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522376559.json"}},{"package":{"name":"platform/hardware/nxp/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d","target":{"function":"phTmlNfc_TmlThread","file":"snxxx/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"function_hash":"114290257722219193526046978192912268280","length":2830},"id":"ASB-A-522376559-12cc917a","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d","target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc","function":"phTmlNfc_ReadAbort"},"deprecated":false,"digest":{"length":325,"function_hash":"250206736237646727872729314262012289095"},"id":"ASB-A-522376559-15dc38be","signature_type":"Function"},{"id":"ASB-A-522376559-40d7a98e","match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d","target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["144722185872458352175695309995412161175","266398905134325890997895978440588504970","115336630579501178796342975358812085604","253957693696326673168358941375493745845","234558396294514808921723259972505558560","39415392936972581800397717124168780807","327196665478299826929701536419826278121","188048062670159779650524256944277490948","39702670087852557057074381422778856982","130024807833773936668370085431107765687","59827619814627849540325519557903963717","135236032354579975889995765401222591229","103795969636534287899232264288749651503","41376380536892647265902818426369456488","22163985884780806184353380514138073853","209292399499066018765389665177809443180","107223334400844073881200238028961841886","302532930595921609684880952382230647687"]}},{"target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc","function":"phTmlNfc_TmlThread"},"deprecated":false,"digest":{"length":2774,"function_hash":"36253413422107638751724557129333465245"},"id":"ASB-A-522376559-5566a31c","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d"},{"id":"ASB-A-522376559-918e15c8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d","target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"line_hashes":["94819916502523114305836174566238729646","147954369963902169108221791516930027988","77235648048634745239559180971320411516","302532930595921609684880952382230647687"],"threshold":0.9}},{"target":{"function":"phTmlNfc_ReadAbort","file":"pn8x/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"function_hash":"260895799017144006521655962357376492512","length":213},"id":"ASB-A-522376559-bc0ae88c","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d"},{"source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d","target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"line_hashes":["137729986726834220153758843001342381987","34690655052730806104815974042755490950","314867958065263402798590851395676189680","99843953941826109628306304468982929747","74823944509944921546644574926987282827","194859648925305615769019290086493649946","111665456638357796684350143075108643334","285467037410426999516727484614337059866","172925267726085532505909612717220357447","130024807833773936668370085431107765687","59827619814627849540325519557903963717","135236032354579975889995765401222591229","103795969636534287899232264288749651503","41376380536892647265902818426369456488","22163985884780806184353380514138073853","209292399499066018765389665177809443180","107223334400844073881200238028961841886","302532930595921609684880952382230647687"],"threshold":0.9},"id":"ASB-A-522376559-c8ef44eb","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d","target":{"function":"phTmlNfc_ReadAbort","file":"snxxx/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"function_hash":"260895799017144006521655962357376492512","length":213},"id":"ASB-A-522376559-d644093b","match_only_versions":["16-qpr2"],"signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522376559.json"}},{"package":{"name":"platform/hardware/nxp/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18"],"severity":"Critical","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":325,"function_hash":"250206736237646727872729314262012289095"},"id":"ASB-A-522376559-5ae7a643","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18","target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc","function":"phTmlNfc_ReadAbort"}},{"digest":{"length":213,"function_hash":"260895799017144006521655962357376492512"},"id":"ASB-A-522376559-65a4f653","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18","target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc","function":"phTmlNfc_ReadAbort"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18","target":{"file":"snxxx/halimpl_v2/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"line_hashes":["94819916502523114305836174566238729646","147954369963902169108221791516930027988","77235648048634745239559180971320411516","302532930595921609684880952382230647687"],"threshold":0.9},"id":"ASB-A-522376559-79cebbbb","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18","target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc","function":"phTmlNfc_ReadAbort"},"deprecated":false,"digest":{"function_hash":"260895799017144006521655962357376492512","length":213},"id":"ASB-A-522376559-81c0be2c","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18","target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"line_hashes":["137729986726834220153758843001342381987","34690655052730806104815974042755490950","314867958065263402798590851395676189680","99843953941826109628306304468982929747","74823944509944921546644574926987282827","194859648925305615769019290086493649946","111665456638357796684350143075108643334","285467037410426999516727484614337059866","172925267726085532505909612717220357447","130024807833773936668370085431107765687","59827619814627849540325519557903963717","135236032354579975889995765401222591229","103795969636534287899232264288749651503","41376380536892647265902818426369456488","22163985884780806184353380514138073853","209292399499066018765389665177809443180","107223334400844073881200238028961841886","302532930595921609684880952382230647687"],"threshold":0.9},"id":"ASB-A-522376559-b44adfbb"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18","target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc","function":"phTmlNfc_TmlThread"},"deprecated":false,"digest":{"length":2774,"function_hash":"36253413422107638751724557129333465245"},"id":"ASB-A-522376559-bf454f99","match_only_versions":["17"]},{"id":"ASB-A-522376559-d0c43389","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18","target":{"file":"snxxx/halimpl/tml/phTmlNfc.cc","function":"phTmlNfc_TmlThread"},"deprecated":false,"digest":{"length":2830,"function_hash":"114290257722219193526046978192912268280"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18","target":{"file":"pn8x/halimpl/tml/phTmlNfc.cc"},"deprecated":false,"digest":{"line_hashes":["144722185872458352175695309995412161175","266398905134325890997895978440588504970","115336630579501178796342975358812085604","253957693696326673168358941375493745845","234558396294514808921723259972505558560","39415392936972581800397717124168780807","327196665478299826929701536419826278121","188048062670159779650524256944277490948","39702670087852557057074381422778856982","130024807833773936668370085431107765687","59827619814627849540325519557903963717","135236032354579975889995765401222591229","103795969636534287899232264288749651503","41376380536892647265902818426369456488","22163985884780806184353380514138073853","209292399499066018765389665177809443180","107223334400844073881200238028961841886","302532930595921609684880952382230647687"],"threshold":0.9},"id":"ASB-A-522376559-eaab66b9","match_only_versions":["17"]}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522376559.json"}}],"schema_version":"1.9.2"}