Google Cloud warns three AMD Turin CPU flaws could leak data inside VMs

Google Cloud said its affected machine series are C4D, N4D, H4D, Z4D and G4, including bare-metal C4D and Z4D. The flaws are Transient Scheduler Attacks, a class of side-channel issues where speculative execution and scheduling behavior leak information. Two, TSA-SQ and TSA-L1, were disclosed in July 2025 for older EPYC chips. The third, CVE-2026-0004, is new and may let a local attacker infer data from the L1 data cache. Google rates the issue Medium.

The evidence trail runs from CVE records to vendor advisories. CVE-2024-36350 and CVE-2024-36357 cover TSA-SQ and TSA-L1; CVE-2026-0004 covers the new variant that Xen Project calls TSA-Fill. AMD's Zen 5 bulletin says all three are local attacks with high attack complexity and low privileges. Google said it already applied host-side and VM-to-VM mitigations, but inside a VM the risk shifts to process-to-process isolation. The CISA KEV catalog does not list any of the three, and neither vendor reports exploitation.

The pattern is a hardware flaw moving from hypervisor risk to tenant risk. Earlier TSA disclosures led Google to tell customers on Rome, Milan and Genoa processors to patch and stop-and-start. AMD says Zen 5 is impacted differently from earlier parts, and Xen corrected an earlier statement that Zen 5 was not vulnerable to TSA-SQ and TSA-L1. For self-hosted Turin servers, AMD says both platform firmware and OS updates are needed. The Linux kernel already contains a TSA mitigation, Xen has published hypervisor patches, and microcode has been in linux-firmware since Sept. 23.

The operational stakes are cloud isolation. A patched guest kernel can enable mitigations only after Google updates CPU information reported to the VM, and the VM must be stopped and started, not merely rebooted. GKE node images for Turin bare metal were not listed as available, while Cloud Run needs no customer action. Debian still lists bookworm, trixie and forky kernels as vulnerable to CVE-2026-0004, and AMD warns mitigations may affect performance. That leaves administrators to weigh workload risk against restart and performance costs.