Google Cloud VMs on AMD Turin chips want a visitor OS patch and a stop-and-start to guard in opposition to three CPU side-channel flaws, Google stated this week.
The corporate has already utilized mitigations in opposition to assaults between VMs, and between VMs and the host. Inside a VM, the failings could let an attacker with code on the identical processor core infer knowledge from different processes or the kernel.
The affected machine sequence are C4D, N4D, H4D, Z4D,, and G4, together with bare-metal cases of C4D and Z4D. Turin is the code title for fifth-generation AMD EPYC processors.
All three flaws are Transient Scheduler Assaults (TSA). Two of them, TSA-SQ (CVE-2024-36350) and TSA-L1 (CVE-2024-36357), have been first disclosed on July 8, 2025, for earlier EPYC processors.
AMD now says its Zen 5 processors, which embody Turin, are “impacted in a different way from beforehand characterised AMD processors.” The third flaw, CVE-2026-0004, is new. It might let an attacker who can run code on a system infer knowledge within the processor’s L1 knowledge cache.
The Xen Undertaking, which maintains the Xen hypervisor, calls the brand new flaw TSA-Fill. It additionally says an earlier assertion has been corrected: “AMD had beforehand stated that Zen5 CPUs weren’t weak to TSA-SQ and TSA-L1.”
Google charges the difficulty Medium. AMD classifies all three as native assaults with excessive assault complexity that require solely low privileges, in line with its Zen 5 bulletin and CVE-2026-0004 advisory.
As of right now, not one of the three is within the KEV catalog of exploited flaws saved by the U.S. Cybersecurity and Infrastructure Safety Company. Neither firm reviews any exploitation in its bulletins.
What Google Cloud Prospects Have to Do
Google’s safety bulletin provides these steps for every service:
- VMs: Set up your OS vendor’s repair when it ships. Beginning this week, the corporate will replace the CPU info that VMs report, so a patched visitor kernel can activate its mitigations. After that replace reaches a VM, cease and begin it. As the corporate places it: “Rebooting the visitor OS is not sufficient.”
- Naked metallic cases: In case you run your personal OS or hypervisor on a C4D or Z4D naked metallic occasion, apply your vendor’s fixes when they’re accessible.
- Hypervisors inside a VM: The identical CPU info replace applies, so patched visitor kernels can activate their mitigations. Cease and begin the VM as soon as the replace arrives.
- GKE: Up to date node photos for Turin-based naked metallic cases will likely be made accessible, and upgrading nodes picks up the CPU info replace. As of right now, the bulletin doesn’t but listing them as accessible.
- Cloud Run: No motion is required.
Prospects on older Rome, Milan, and Genoa processors obtained the identical stop-and-start instruction in an earlier bulletin on the time of the unique disclosure on July 8, 2025.
The corporate lists nothing to do within the meantime for VMs whose OS vendor has not but shipped a repair. It additionally doesn’t say the way to inform when the CPU info replace has reached a VM.
A kernel commit that mitigates TSA on Zen 5, together with the brand new variant, is within the Linux kernel supply tree. As of right now, Debian has fastened CVE-2026-0004 in its Linux kernel solely in its unstable department. Its safety tracker nonetheless lists the kernels in bookworm, trixie, and forky as weak.
For Turin servers by yourself {hardware}, AMD says each platform firmware and OS updates are wanted to mitigate the failings totally. The mitigation could have an effect on efficiency, and directors ought to weigh the chance to their very own workloads, in line with its technical steerage.
The Xen Undertaking has printed hypervisor patches in its Xen advisory. It says microcode for all TSA flaws on Zen 5 has been in linux-firmware since September 23.
