Google Cloud Warns Customers Over AMD Turin CPU Flaws in VMs

Google Cloud has issued a warning to customers operating virtual machines (VMs) powered by AMD Turin processors, detailing three side-channel flaws that could lead to data leakage across processes within a VM. The vulnerabilities require customer action, including guest operating system patches and a ‘stop and start’ of affected VMs.

The affected infrastructure includes Google Cloud’s C4D, N4D, H4D, Z4D, and G4 machine series, which utilise AMD’s fifth-generation EPYC processors, code-named Turin. This also extends to bare-metal instances of C4D and Z4D.

All three identified flaws are classified as Transient Scheduler Attacks (TSA). Two of these, TSA-SQ (CVE-2024-36350) and TSA-L1 (CVE-2024-36357), were initially disclosed on 8 July 2025 for earlier EPYC processors. AMD has since clarified that its Zen 5 processors, including Turin, are “impacted differently from previously characterised AMD processors,” correcting an earlier statement that Zen 5 CPUs were not vulnerable to TSA-SQ and TSA-L1.

The third flaw, CVE-2026-0004, is new and is dubbed TSA-Fill by the Xen Project. This vulnerability could allow an attacker with code execution on a system to infer data from the processor’s L1 data cache.

The primary risk from these flaws is data inference: an attacker with code running on the same processor core inside a VM could potentially infer sensitive data from other processes or the kernel. Google rates the overall issue as Medium severity. AMD classifies all three vulnerabilities as local attacks requiring low privileges but with high attack complexity, according to its Zen 5 bulletin and the CVE-2026-0004 advisory.

Neither Google nor AMD has reported any evidence of these flaws being exploited in the wild, and none of the three CVEs are currently listed in the U.S. Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities catalogue.

Customer Action Required for Google Cloud Services

Google Cloud has already implemented mitigations to prevent attacks between VMs and between VMs and the host. However, customers are required to take specific steps to protect against intra-VM attacks:

• For VMs: Customers must install their operating system vendor’s fix when available. Starting this week, Google will update the CPU information reported by VMs to allow patched guest kernels to activate mitigations. Once this update reaches a VM, users must stop and then start the VM again; merely rebooting the guest OS is insufficient.
• For Bare Metal Instances: If running a custom OS or hypervisor on C4D or Z4D bare metal instances, customers should apply vendor fixes as they become available.
• For Hypervisors within a VM: The same CPU information update and subsequent ‘stop and start’ procedure applies once the update is received.
• For GKE: Updated node images for Turin-based bare metal instances will be made available. Upgrading nodes will incorporate the CPU information update. As of the time of the bulletin, these updates were not yet available.
• For Cloud Run: No action is required from customers using Cloud Run.

Google Cloud has not provided guidance on how customers can determine when the CPU information update has reached their specific VMs, nor has it outlined interim measures for VMs awaiting OS vendor patches.

For organisations managing Turin servers on their own hardware, AMD advises that both platform firmware and OS updates are necessary for full mitigation. The company warns that these mitigations may impact performance, suggesting administrators weigh the risks for their specific workloads. The Xen Project has also published hypervisor patches in its advisory, noting that microcode for all TSA flaws on Zen 5 has been included in linux-firmware since 23 September.

A kernel commit addressing TSA on Zen 5, including the new variant, is present in the Linux kernel source tree. Debian has already fixed CVE-2026-0004 in its Linux kernel unstable branch, though its security tracker still lists the bookworm, trixie, and forky kernels as vulnerable.