CVE-2026-53370

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel: Improve validation and configuration of ACR masks

Currently there are several issues on the user space ACR mask validation

and configuration.

- The validation for user space ACR mask (attr.config2) is incomplete,

e.g., the ACR mask could include the index which belongs to another

ACR events group, but it's not validated.

- An early return on an invalid ACR mask caused all subsequent ACR groups

to be skipped.

- The stale hardware ACR mask (hw.config1) is not cleared before setting

new hardware ACR mask.

The following changes address all of the above issues.

- Figure out the event index group of an ACR group. Any bits in the

user-space mask not present in the index group are now dropped.

- Instead of an early return on invalid bits, drop only the invalid

portions and continue iterating through all ACR events to ensure full

configuration.

- Explicitly clear the stale hardware ACR mask for

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References