In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e"
],
"severity": "Critical",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "36253413422107638751724557129333465245",
"length": 2774
},
"id": "ASB-A-522376559-12bce048",
"match_only_versions": [
"17-qpr2-next"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_TmlThread"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260895799017144006521655962357376492512",
"length": 213
},
"id": "ASB-A-522376559-144c42d9",
"match_only_versions": [
"17-qpr2-next"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260895799017144006521655962357376492512",
"length": 213
},
"id": "ASB-A-522376559-1fb5b364",
"match_only_versions": [
"17-qpr2-next"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "250206736237646727872729314262012289095",
"length": 325
},
"id": "ASB-A-522376559-3227efcc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e",
"target": {
"file": "snxxx/halimpl_v2/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"137729986726834220153758843001342381987",
"34690655052730806104815974042755490950",
"314867958065263402798590851395676189680",
"99843953941826109628306304468982929747",
"74823944509944921546644574926987282827",
"194859648925305615769019290086493649946",
"111665456638357796684350143075108643334",
"285467037410426999516727484614337059866",
"172925267726085532505909612717220357447",
"130024807833773936668370085431107765687",
"59827619814627849540325519557903963717",
"135236032354579975889995765401222591229",
"103795969636534287899232264288749651503",
"41376380536892647265902818426369456488",
"22163985884780806184353380514138073853",
"209292399499066018765389665177809443180",
"107223334400844073881200238028961841886",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-62e25f91",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"144722185872458352175695309995412161175",
"266398905134325890997895978440588504970",
"115336630579501178796342975358812085604",
"253957693696326673168358941375493745845",
"234558396294514808921723259972505558560",
"39415392936972581800397717124168780807",
"327196665478299826929701536419826278121",
"188048062670159779650524256944277490948",
"39702670087852557057074381422778856982",
"130024807833773936668370085431107765687",
"59827619814627849540325519557903963717",
"135236032354579975889995765401222591229",
"103795969636534287899232264288749651503",
"41376380536892647265902818426369456488",
"22163985884780806184353380514138073853",
"209292399499066018765389665177809443180",
"107223334400844073881200238028961841886",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-6e940db1",
"match_only_versions": [
"17-qpr2-next"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"94819916502523114305836174566238729646",
"147954369963902169108221791516930027988",
"77235648048634745239559180971320411516",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-8525f208",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e",
"target": {
"file": "snxxx/halimpl_v2/tml/phTmlNfc.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "114290257722219193526046978192912268280",
"length": 2830
},
"id": "ASB-A-522376559-aa7e7e0d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0d57e70d8ca0c887dc7ace540e1afcafe516c2e",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_TmlThread"
}
}
]
}
{
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5"
],
"severity": "Critical",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "114290257722219193526046978192912268280",
"length": 2830
},
"id": "ASB-A-522376559-0fec8399",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_TmlThread"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"137729986726834220153758843001342381987",
"34690655052730806104815974042755490950",
"314867958065263402798590851395676189680",
"99843953941826109628306304468982929747",
"74823944509944921546644574926987282827",
"194859648925305615769019290086493649946",
"111665456638357796684350143075108643334",
"285467037410426999516727484614337059866",
"172925267726085532505909612717220357447",
"130024807833773936668370085431107765687",
"59827619814627849540325519557903963717",
"135236032354579975889995765401222591229",
"103795969636534287899232264288749651503",
"41376380536892647265902818426369456488",
"22163985884780806184353380514138073853",
"209292399499066018765389665177809443180",
"107223334400844073881200238028961841886",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-7ae2c764",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"144722185872458352175695309995412161175",
"266398905134325890997895978440588504970",
"115336630579501178796342975358812085604",
"253957693696326673168358941375493745845",
"234558396294514808921723259972505558560",
"39415392936972581800397717124168780807",
"327196665478299826929701536419826278121",
"188048062670159779650524256944277490948",
"39702670087852557057074381422778856982",
"130024807833773936668370085431107765687",
"59827619814627849540325519557903963717",
"135236032354579975889995765401222591229",
"103795969636534287899232264288749651503",
"41376380536892647265902818426369456488",
"22163985884780806184353380514138073853",
"209292399499066018765389665177809443180",
"107223334400844073881200238028961841886",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-9688315e",
"match_only_versions": [
"16"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260895799017144006521655962357376492512",
"length": 213
},
"id": "ASB-A-522376559-b7d26dab",
"match_only_versions": [
"16"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "36253413422107638751724557129333465245",
"length": 2774
},
"id": "ASB-A-522376559-bb5292fb",
"match_only_versions": [
"16"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_TmlThread"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260895799017144006521655962357376492512",
"length": 213
},
"id": "ASB-A-522376559-e9cec518",
"match_only_versions": [
"16"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/16575d516e84fb6941ef1b1c138833bf20fe9fc5",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
}
]
}
{
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d"
],
"severity": "Critical",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "114290257722219193526046978192912268280",
"length": 2830
},
"id": "ASB-A-522376559-12cc917a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_TmlThread"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "250206736237646727872729314262012289095",
"length": 325
},
"id": "ASB-A-522376559-15dc38be",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d",
"target": {
"file": "snxxx/halimpl_v2/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"144722185872458352175695309995412161175",
"266398905134325890997895978440588504970",
"115336630579501178796342975358812085604",
"253957693696326673168358941375493745845",
"234558396294514808921723259972505558560",
"39415392936972581800397717124168780807",
"327196665478299826929701536419826278121",
"188048062670159779650524256944277490948",
"39702670087852557057074381422778856982",
"130024807833773936668370085431107765687",
"59827619814627849540325519557903963717",
"135236032354579975889995765401222591229",
"103795969636534287899232264288749651503",
"41376380536892647265902818426369456488",
"22163985884780806184353380514138073853",
"209292399499066018765389665177809443180",
"107223334400844073881200238028961841886",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-40d7a98e",
"match_only_versions": [
"16-qpr2"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "36253413422107638751724557129333465245",
"length": 2774
},
"id": "ASB-A-522376559-5566a31c",
"match_only_versions": [
"16-qpr2"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_TmlThread"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"94819916502523114305836174566238729646",
"147954369963902169108221791516930027988",
"77235648048634745239559180971320411516",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-918e15c8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d",
"target": {
"file": "snxxx/halimpl_v2/tml/phTmlNfc.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260895799017144006521655962357376492512",
"length": 213
},
"id": "ASB-A-522376559-bc0ae88c",
"match_only_versions": [
"16-qpr2"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"137729986726834220153758843001342381987",
"34690655052730806104815974042755490950",
"314867958065263402798590851395676189680",
"99843953941826109628306304468982929747",
"74823944509944921546644574926987282827",
"194859648925305615769019290086493649946",
"111665456638357796684350143075108643334",
"285467037410426999516727484614337059866",
"172925267726085532505909612717220357447",
"130024807833773936668370085431107765687",
"59827619814627849540325519557903963717",
"135236032354579975889995765401222591229",
"103795969636534287899232264288749651503",
"41376380536892647265902818426369456488",
"22163985884780806184353380514138073853",
"209292399499066018765389665177809443180",
"107223334400844073881200238028961841886",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-c8ef44eb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260895799017144006521655962357376492512",
"length": 213
},
"id": "ASB-A-522376559-d644093b",
"match_only_versions": [
"16-qpr2"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9bba1395f8f9ff0e7c3fa23b4d537a7e834fc67d",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
}
]
}
{
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18"
],
"severity": "Critical",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "250206736237646727872729314262012289095",
"length": 325
},
"id": "ASB-A-522376559-5ae7a643",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18",
"target": {
"file": "snxxx/halimpl_v2/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260895799017144006521655962357376492512",
"length": 213
},
"id": "ASB-A-522376559-65a4f653",
"match_only_versions": [
"17"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"94819916502523114305836174566238729646",
"147954369963902169108221791516930027988",
"77235648048634745239559180971320411516",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-79cebbbb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18",
"target": {
"file": "snxxx/halimpl_v2/tml/phTmlNfc.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260895799017144006521655962357376492512",
"length": 213
},
"id": "ASB-A-522376559-81c0be2c",
"match_only_versions": [
"17"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_ReadAbort"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"137729986726834220153758843001342381987",
"34690655052730806104815974042755490950",
"314867958065263402798590851395676189680",
"99843953941826109628306304468982929747",
"74823944509944921546644574926987282827",
"194859648925305615769019290086493649946",
"111665456638357796684350143075108643334",
"285467037410426999516727484614337059866",
"172925267726085532505909612717220357447",
"130024807833773936668370085431107765687",
"59827619814627849540325519557903963717",
"135236032354579975889995765401222591229",
"103795969636534287899232264288749651503",
"41376380536892647265902818426369456488",
"22163985884780806184353380514138073853",
"209292399499066018765389665177809443180",
"107223334400844073881200238028961841886",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-b44adfbb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "36253413422107638751724557129333465245",
"length": 2774
},
"id": "ASB-A-522376559-bf454f99",
"match_only_versions": [
"17"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_TmlThread"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "114290257722219193526046978192912268280",
"length": 2830
},
"id": "ASB-A-522376559-d0c43389",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18",
"target": {
"file": "snxxx/halimpl/tml/phTmlNfc.cc",
"function": "phTmlNfc_TmlThread"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"144722185872458352175695309995412161175",
"266398905134325890997895978440588504970",
"115336630579501178796342975358812085604",
"253957693696326673168358941375493745845",
"234558396294514808921723259972505558560",
"39415392936972581800397717124168780807",
"327196665478299826929701536419826278121",
"188048062670159779650524256944277490948",
"39702670087852557057074381422778856982",
"130024807833773936668370085431107765687",
"59827619814627849540325519557903963717",
"135236032354579975889995765401222591229",
"103795969636534287899232264288749651503",
"41376380536892647265902818426369456488",
"22163985884780806184353380514138073853",
"209292399499066018765389665177809443180",
"107223334400844073881200238028961841886",
"302532930595921609684880952382230647687"
],
"threshold": 0.9
},
"id": "ASB-A-522376559-eaab66b9",
"match_only_versions": [
"17"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9e084568ba3449efe5d1a2f7186ccf79866bfc18",
"target": {
"file": "pn8x/halimpl/tml/phTmlNfc.cc"
}
}
]
}