Google Cloud has issued a security warning over three processor-level vulnerabilities affecting virtual machines running on AMD’s fifth-generation EPYC Turin processors, warning that the flaws could allow attackers to extract sensitive information from other processes or the operating system kernel.
The vulnerabilities, classified as Transient Scheduler Attacks (TSA), could enable an attacker who can execute code on the same physical processor core to infer data belonging to other workloads running within a virtual machine.
Google said it has already deployed protective measures against attacks targeting communication between separate virtual machines and between virtual machines and their host systems. However, the vulnerabilities could still expose information between processes operating inside the same virtual machine.
The affected Google Cloud machine families include C4D, N4D, H4D, Z4D and G4. Bare-metal instances belonging to the C4D and Z4D series are also affected.
AMD Turin is the codename for the company’s fifth-generation EPYC server processors, which are built on the Zen 5 architecture.
All three vulnerabilities belong to the Transient Scheduler Attack category. Two of them, identified as CVE-2024-36350 (TSA-SQ) and CVE-2024-36357 (TSA-L1), were originally disclosed on July 8, 2025, in connection with earlier EPYC processor generations.
AMD has now clarified that Zen 5 processors, including Turin, are affected differently from previously examined AMD processor architectures.
The third vulnerability, CVE-2026-0004, is newly disclosed and could allow an attacker capable of executing code on a system to infer information stored in the processor’s L1 data cache.
The Xen Project, which maintains the Xen hypervisor, has named the newly identified vulnerability TSA-Fill. The project also corrected an earlier statement, explaining that AMD had previously indicated that Zen 5 processors were not affected by TSA-SQ and TSA-L1.
Google has classified the security issues as Medium severity. AMD describes all three as local attacks requiring high attack complexity but only low privileges.
As of November 12, 2026, none of the vulnerabilities had been added to the Known Exploited Vulnerabilities (KEV) catalogue maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Neither Google nor AMD reported evidence of active exploitation in their respective security advisories.
What Google Cloud Customers Should Do
Google has outlined mitigation requirements for customers depending on the services and infrastructure they operate.
For virtual machines, customers are advised to install security patches provided by their operating system vendors once the updates become available.
After the CPU information update reaches a virtual machine, administrators must stop and restart the instance to complete the mitigation.
Google specifically warned that simply rebooting the guest operating system would not be sufficient.
Customers operating their own operating systems or hypervisors on C4D and Z4D bare-metal instances must also install the relevant updates once released by their software vendors.
For hypervisors running inside virtual machines, the same CPU information update will enable patched guest kernels to activate their protections. Administrators must subsequently stop and restart the affected virtual machines.
Google Kubernetes Engine (GKE) customers will receive updated node images for Turin-based bare-metal instances. Upgrading the nodes will also incorporate the CPU information update.
However, Google’s security bulletin had not yet listed the updated GKE node images as available at the time of publication.
Customers using Cloud Run do not need to take any action.
Google also noted that customers operating older AMD EPYC Rome, Milan and Genoa processors received similar stop-and-start instructions following the disclosure of related vulnerabilities in July 2025.
The company did not provide an interim mitigation for virtual machines whose operating system vendors have not yet released the required security patches. It also did not explain how administrators could independently verify when the CPU information update had reached their virtual machines.
Linux and Xen Security Updates
A security mitigation addressing Transient Scheduler Attacks on Zen 5 processors, including the newly disclosed TSA-Fill variant, has been incorporated into the Linux kernel source tree.
However, the availability of the fix varies across Linux distributions.
As of November 12, Debian had incorporated a fix for CVE-2026-0004 into its unstable development branch. Its security tracker continued to identify the kernel packages in Bookworm, Trixie and Forky as vulnerable.
For organisations operating AMD Turin servers on their own hardware, AMD recommends applying both platform firmware and operating system updates to achieve complete protection against the vulnerabilities.
The company cautioned that the security measures could affect processor performance. System administrators are therefore advised to evaluate the potential impact based on their workloads and security requirements.
The Xen Project has also published hypervisor patches addressing the vulnerabilities through its security advisory.
Additionally, the project disclosed that microcode covering all three TSA vulnerabilities affecting Zen 5 processors has been available through the Linux firmware repository since September 23, 2026.
The disclosure highlights continuing security concerns surrounding processor-level vulnerabilities in cloud computing environments, particularly where multiple applications and workloads share physical processing resources.
Google Cloud customers running affected AMD Turin-based infrastructure are advised to monitor security updates from their operating system and hypervisor vendors, install available patches and follow Google’s instructions to stop and restart affected instances.