The Linux kernel vulnerability CVE-2026-53370 involves flaws in the perf/x86/intel subsystem's handling of ACR masks. User space ACR mask validation was incomplete, allowing bits from other event groups to be included without proper checks. Additionally, an early return on detecting invalid bits caused subsequent ACR groups to be skipped, and stale hardware masks were not cleared before setting new ones. The patch addresses these by dropping invalid bits instead of aborting, clearing stale hardware masks explicitly, and iterating through all ACR events to ensure complete configuration. A noted theoretical issue with non-leader event members potentially causing bit-shifting errors remains but is considered low risk due to ACR sampling requirements.

The vulnerability could lead to improper configuration of ACR masks in the Linux kernel's perf subsystem, potentially causing denial of service or instability (as indicated by the CVSS vector showing no confidentiality or integrity impact but high availability impact). There is no indication of confidentiality or integrity compromise. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to address this vulnerability by improving validation and configuration of ACR masks. Users should apply the official kernel updates that include these changes. Since no patch links are provided here, users should consult their Linux distribution or kernel vendor advisories for the relevant fixed versions. No additional mitigation is indicated.