Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week.
Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week.
The company has already applied mitigations against attacks between VMs, and between VMs and the host; inside a VM, the flaws may let an attacker with code on the same processor core infer data from other processes or the kernel.
Two of them, TSA-SQ (CVE-2024-36350) and TSA-L1 (CVE-2024-36357), were first disclosed on July 8, 2025, for earlier EPYC processors; the Xen Project, which maintains the Xen hypervisor, calls the new flaw TSA-Fill.
The affected machine series are C4D, N4D, H4D, Z4D,, and G4, including bare-metal instances of C4D and Z4D, and it may let an attacker who can run code on a system infer data in the processor's L1 data cache.
AMD classifies all three as local attacks with high attack complexity that require only low privileges, according to its Zen 5 bulletin and CVE-2026-0004 advisory.
The mitigation may affect performance, and administrators should weigh the risk to their own workloads, according to its technical guidance.
As of today, none of the three is in the KEV catalog of exploited flaws kept by the U.S. Cybersecurity and Infrastructure Security Agency, and a kernel commit that mitigates TSA on Zen 5, including the new variant, is in the Linux kernel source tree.
As of today, Debian has fixed CVE-2026-0004 in its Linux kernel only in its unstable branch.
The company lists nothing to do in the meantime for VMs whose OS vendor has not yet shipped a fix; it also does not say how to tell when the CPU information update has reached a VM.
For Turin servers on your own hardware, AMD says both platform firmware and OS updates are needed to mitigate the flaws fully, and the Xen Project has published hypervisor patches in its Xen advisory.
What happened
Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week.
The company has already applied mitigations against attacks between VMs, and between VMs and the host; inside a VM, the flaws may let an attacker with code on the same processor core infer data from other processes or the kernel.
What changed
Two of them, TSA-SQ (CVE-2024-36350) and TSA-L1 (CVE-2024-36357), were first disclosed on July 8, 2025, for earlier EPYC processors; the Xen Project, which maintains the Xen hypervisor, calls the new flaw TSA-Fill.
Who is affected
The affected machine series are C4D, N4D, H4D, Z4D,, and G4, including bare-metal instances of C4D and Z4D, and it may let an attacker who can run code on a system infer data in the processor's L1 data cache.
Why it matters
AMD classifies all three as local attacks with high attack complexity that require only low privileges, according to its Zen 5 bulletin and CVE-2026-0004 advisory.
The mitigation may affect performance, and administrators should weigh the risk to their own workloads, according to its technical guidance.
Technical details
As of today, none of the three is in the KEV catalog of exploited flaws kept by the U.S. Cybersecurity and Infrastructure Security Agency, and a kernel commit that mitigates TSA on Zen 5, including the new variant, is in the Linux kernel source tree.
As of today, Debian has fixed CVE-2026-0004 in its Linux kernel only in its unstable branch.
Response
The company lists nothing to do in the meantime for VMs whose OS vendor has not yet shipped a fix; it also does not say how to tell when the CPU information update has reached a VM.
What security teams should do
For Turin servers on your own hardware, AMD says both platform firmware and OS updates are needed to mitigate the flaws fully, and the Xen Project has published hypervisor patches in its Xen advisory.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.