diff --git a/pkg/ring0/entry_amd64.s b/pkg/ring0/entry_amd64.s
index 218eb3fea..0acf3a96c 100644
--- a/pkg/ring0/entry_amd64.s
+++ b/pkg/ring0/entry_amd64.s
@@ -88,12 +88,13 @@
 #define PTRACE_FS_BASE  168 // +checkoffset linux PtraceRegs.Fs_base
 #define PTRACE_GS_BASE  176 // +checkoffset linux PtraceRegs.Gs_base
 
-// The value for XCR0 is defined to xsave/xrstor everything except for AMX
-// regions.
-// TODO(gvisor.dev/issues/9896): Implement AMX Support.
-#define XCR0_AMX_MASK ((1 << 17) | (1 << 18))
-#define XCR0_EAX      (0xffffffff ^ XCR0_AMX_MASK)
-#define XCR0_EDX      0xffffffff
+// The value for XCR0 is defined to xsave/xrstor everything except for PKRU and
+// AMX regions.
+// TODO(gvisor.dev/issues/9896): Implement AMX support.
+// TODO(gvisor.dev/issues/10087): Implement PKRU support.
+#define XCR0_DISABLED_MASK ((1 << 9) | (1 << 17) | (1 << 18))
+#define XCR0_EAX (0xffffffff ^ XCR0_DISABLED_MASK)
+#define XCR0_EDX 0xffffffff
 
 // Saves a register set.
 //
diff --git a/pkg/ring0/lib_amd64.go b/pkg/ring0/lib_amd64.go
index 73f774667..fe69b6988 100644
--- a/pkg/ring0/lib_amd64.go
+++ b/pkg/ring0/lib_amd64.go
@@ -119,8 +119,8 @@ func Init(fs cpuid.FeatureSet) {
 	hasFSGSBASE = fs.HasFeature(cpuid.X86FeatureFSGSBase)
 	validXCR0Mask = uintptr(fs.ValidXCR0Mask())
 	if hasXSAVE {
-		XCR0AMXMask := uintptr((1 << 17) | (1 << 18))
-		localXCR0 = xgetbv(0) &^ XCR0AMXMask
+		XCR0DisabledMask := uintptr((1 << 9) | (1 << 17) | (1 << 18))
+		localXCR0 = xgetbv(0) &^ XCR0DisabledMask
 	}
 }
 
diff --git a/pkg/sentry/arch/fpu/fpu_amd64.s b/pkg/sentry/arch/fpu/fpu_amd64.s
index 61d3676ca..53ae46ca1 100644
--- a/pkg/sentry/arch/fpu/fpu_amd64.s
+++ b/pkg/sentry/arch/fpu/fpu_amd64.s
@@ -22,12 +22,13 @@
 // FXSAVE/XSAVE area. (Intel SDM Vol. 1, Table 10-2 "Format of an FXSAVE Area")
 #define MXCSR_OFFSET	24
 
-// The value for XCR0 is defined to xsave/xrstor everything except for AMX
-// regions.
-// TODO(gvisor.dev/issues/9896): Implement AMX Support.
-#define XCR0_AMX_MASK ((1 << 17) | (1 << 18))
-#define XCR0_EAX      (0xffffffff ^ XCR0_AMX_MASK)
-#define XCR0_EDX      0xffffffff
+// The value for XCR0 is defined to xsave/xrstor everything except for PKRU and
+// AMX regions.
+// TODO(gvisor.dev/issues/9896): Implement AMX support.
+// TODO(gvisor.dev/issues/10087): Implement PKRU support.
+#define XCR0_DISABLED_MASK ((1 << 9) | (1 << 17) | (1 << 18))
+#define XCR0_EAX (0xffffffff ^ XCR0_DISABLED_MASK)
+#define XCR0_EDX 0xffffffff
 
 // initX86FPState initializes floating point state.
 //
diff --git a/pkg/sentry/platform/systrap/sysmsg/sighandler_amd64.c b/pkg/sentry/platform/systrap/sysmsg/sighandler_amd64.c
index 65776c95a..b3d6e98d9 100644
--- a/pkg/sentry/platform/systrap/sysmsg/sighandler_amd64.c
+++ b/pkg/sentry/platform/systrap/sysmsg/sighandler_amd64.c
@@ -480,7 +480,7 @@ static void prep_fpstate_for_sigframe(void *buf, uint32_t user_size,
 
   sw_bytes->magic1 = FP_XSTATE_MAGIC1;
   sw_bytes->extended_size = user_size + FP_XSTATE_MAGIC2_SIZE;
-  sw_bytes->xfeatures = ~(0ULL) ^ (XCR0_AMX_MASK);
+  sw_bytes->xfeatures = ~(0ULL) ^ (XCR0_DISABLED_MASK);
   sw_bytes->xstate_size = user_size;
   *(uint32_t *)(buf + user_size) = use_xsave ? FP_XSTATE_MAGIC2 : 0;
 }
diff --git a/pkg/sentry/platform/systrap/sysmsg/sysmsg_offsets.h b/pkg/sentry/platform/systrap/sysmsg/sysmsg_offsets.h
index 51fa2ed31..1e74f89fd 100644
--- a/pkg/sentry/platform/systrap/sysmsg/sysmsg_offsets.h
+++ b/pkg/sentry/platform/systrap/sysmsg/sysmsg_offsets.h
@@ -20,11 +20,12 @@
 // for the pkg/sentry/platform/systrap/usertrap package.
 #define FAULT_OPCODE 0x06
 
-// The value for XCR0 is defined to xsave/xrstor everything except for AMX
-// regions.
-// TODO(gvisor.dev/issues/9896): Implement AMX Support.
-#define XCR0_AMX_MASK ((1 << 17) | (1 << 18))
-#define XCR0_EAX (0xffffffff ^ XCR0_AMX_MASK)
+// The value for XCR0 is defined to xsave/xrstor everything except for PKRU and
+// AMX regions.
+// TODO(gvisor.dev/issues/9896): Implement AMX support.
+// TODO(gvisor.dev/issues/10087): Implement PKRU support.
+#define XCR0_DISABLED_MASK ((1 << 9) | (1 << 17) | (1 << 18))
+#define XCR0_EAX (0xffffffff ^ XCR0_DISABLED_MASK)
 #define XCR0_EDX 0xffffffff
 
 // LINT.IfChange