Google Cloud Warns of Three CPU Side-Channel Flaws Affecting AMD Turin Processors
Google Cloud has identified three Transient Scheduler Attacks (TSA) vulnerabilities impacting AMD Turin processors in its virtual machines, potentially allowing data leakage between processes.
Google Cloud has alerted its customers to three newly identified CPU side-channel vulnerabilities affecting AMD's Turin processors, which are used in various Google Cloud virtual machine and bare-metal instances. These flaws, collectively categorized as Transient Scheduler Attacks (TSA), could enable an attacker with code execution capabilities within a virtual machine (VM) to infer sensitive data from other processes or even the host kernel.
The affected Google Cloud machine series include C4D, N4D, H4D, Z4D, and G4, as well as bare-metal instances of C4D and Z4D. Turin is the codename for AMD's fifth-generation EPYC processors. Google has already implemented host-level mitigations to protect against attacks between different VMs and between VMs and the host system. However, the remaining risk lies within a single VM, where an attacker could potentially access data from co-located processes or the underlying operating system kernel.
Two of the identified vulnerabilities, TSA-SQ (CVE-2024-36350) and TSA-L1 (CVE-2024-36357), were previously disclosed in July 2025 for earlier AMD EPYC processor generations. However, AMD has clarified that its newer Zen 5 processors, including the Turin series, are "impacted differently from previously characterized AMD processors." The third vulnerability, CVE-2026-0004, is a new variant that could allow an attacker to infer data residing in the processor's L1 data cache. The Xen Project, responsible for the Xen hypervisor, has dubbed this new variant TSA-Fill and noted that AMD had initially stated Zen 5 CPUs were not vulnerable to TSA-SQ and TSA-L1, a statement that has since been corrected.
Google has assigned a 'Medium' severity rating to these issues, while AMD classifies them as local attacks requiring high attack complexity and only low privileges. As of the latest reports, none of these three vulnerabilities have been added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog, and neither Google nor AMD have reported any instances of active exploitation in the wild.
To fully address the risks, Google Cloud customers are advised to take specific actions depending on their service. For standard VMs, users must install their OS vendor's fix once it becomes available and then stop and start the VM after the CPU information update reaches it. A simple reboot of the guest OS is insufficient. For bare metal instances running a self-managed OS or hypervisor, customers need to apply vendor fixes when released. Similar to VMs, hypervisors running inside a VM will also require a stop and start after the guest kernel is patched and the CPU information update is applied.
For Google Kubernetes Engine (GKE) users, updated node images for Turin-based bare metal instances will be provided, and upgrading nodes will incorporate the necessary CPU information update. Customers using Cloud Run require no immediate action. For users running their own hardware with Turin servers, AMD recommends applying both platform firmware and OS updates, noting that these mitigations might impact performance, requiring administrators to weigh the trade-offs for their specific workloads.
Mitigation efforts are underway across the software ecosystem. A kernel commit addressing TSA on Zen 5, including the new variant, is present in the Linux kernel source tree. Debian has already fixed CVE-2026-0004 in its unstable branch, though other branches are still listed as vulnerable. The Xen Project has published hypervisor patches, and microcode for all TSA flaws on Zen 5 has been available in linux-firmware since September 23rd. However, Google notes that for VMs whose OS vendor has not yet shipped a fix, there is no immediate action to take, and it has not specified how to determine when the CPU information update has been applied to a VM.
These vulnerabilities highlight the ongoing challenges in securing modern hardware architectures, particularly in cloud environments where shared infrastructure necessitates robust protection against sophisticated side-channel attacks. The need for coordinated patching across hardware vendors, cloud providers, and operating system developers remains critical to safeguarding sensitive data in virtualized and multi-tenant systems.