Google Cloud has alerted users to three side-channel vulnerabilities affecting VMs running on AMD Turin (Zen 5) CPUs. These flaws could let attackers running within the same processor core extract sensitive data from other processes or even from the kernel. Some mitigations are already in place, but full protection requires customer action.
What’s Vulnerable and How the Risks Arise
The defects impact Google Cloud VM instances on AMD Turin chips across several machine families—C4D, N4D, H4D, Z4D, and G4—including bare-metal offerings. These CPUs are part of AMD’s fifth-generation EPYC lineup.
The issues are three variations of Transient Scheduler Attacks (TSAs). Two, TSA-SQ (CVE-2024-36350) and TSA-L1 (CVE-2024-36357), were publicized in mid-2025 for older EPYC chips. The third, CVE-2026-0004 (dubbed TSA-Fill by the Xen Project), is new; it may allow an attacker with code running on one core to infer data stored in the L1 data cache. AMD now acknowledges that Turin CPUs are affected by all three (including the ones previously thought not to apply).
Severity, Disclosures, and Response Status
Google has classified these vulnerabilities as Medium risk. AMD considers them local attacks—meaning the attacker needs to already have access—but notes that the exploit complexity is high with low privilege requirements. None of the three are listed in CISA’s Known Exploited Vulnerabilities catalog, and no confirmed cases of real-world exploitation have been reported so far.
Mitigations and What Users Must Do
Google’s guidance lays out specific actions by service:
- Virtual Machines (VMs): Install the OS vendor’s patch once available. Updated CPU info—once applied—enables mitigation. After the update appears within the guest kernel, the VM must be stopped and started; simply rebooting the guest OS will not suffice.
- Bare-metal instances: If you’re using your own hypervisor or OS on Turin-based bare metal (C4D or Z4D), apply vendor fixes as they arrive.
- Nested hypervisors: Apply the CPU info update similarly, and perform stop-and-start once it’s present in kernel.
- GKE environments: Node images for Turin bare-metal will include the updates. Upgrading the nodes picks up the required CPU info patch, though as of this week the relevant images are not yet listed as available.
- Cloud Run: No action required.
For older AMD EPYC chips like Rome, Milan, and Genoa, identical stop-and-start instructions were included in an earlier bulletin tied to their TSA disclosures in July 2025.
Patches, Performance, and Ongoing Gaps
Available mitigations include a kernel patch for Zen 5 variants (including this new one), though in some distributions like Debian, the fix for CVE-2026-0004 has only landed in unstable branches. Stable releases are still marked as vulnerable.
Firmware updates (e.g. microcode) are available via linux-firmware for all Zen 5 TSAs as of late September. Those running their own hardware need both firmware and OS updates to fully close the risk—though performance impacts are expected and should be considered based on workload.
Nothing in Google’s bulletin explains how users can definitively know when the CPU info update has been applied to a VM. For VMs without vendor-supplied OS patches, there are currently no workaround steps beyond waiting. Xen Project has released patches and technical advisories to address all three flaws.
Analysis: These new findings stress a persistent reality in cloud and CPU security: cutting-edge processors carry novel risks that even vendors may misclassify initially. The requirement for stop-and-start (not just reboot) for mitigations to kick in, and the lag in patch availability (especially in stable OS releases), leave many users exposed. The cost of inaction could be high for those running sensitive workloads. Moving forward, it’s essential for providers like Google to improve transparency about patch status, and for users to stay abreast of firmware and kernel updates. Watch for performance regressions, and examine whether your deployment models (VM vs bare metal vs nested hypervisor) influence your risk profile.
