Google warns of AMD Turin CPU flaws that could leak data

Google Cloud has warned that three Transient Scheduler Attacks (TSA) affecting AMD’s Zen 5-based Turin processors could enable a guest VM to infer data from other processes or the kernel, even when mitigations exist between VMs or between a VM and its host. The flaws affect Google Cloud’s Turin-based VM families, including C4D, N4D, H4D, Z4D and G4, with bare-metal C4D and Z4D also in scope.

The flaws are TSA-SQ (CVE-2024-36350), TSA-L1 (CVE-2024-36357), which were disclosed on 8 July 2025 for earlier EPYC generations, and a third, CVE-2026-0004, which is new and may let an attacker running code on a system infer data from the L1 data cache. The Xen Project notes this third flaw as TSA-Fill and corrects an earlier AMD statement about Zen 5’s vulnerability to TSA-SQ and TSA-L1.

AMD’s Zen 5 bulletin and AMD’s CVE advisory classify all three as local attacks with high complexity but require only low privileges; Google’s assessment assigns the risk as Medium, and none of the flaws is listed in CISA’s KEV exploited-flaw catalog.

Google’s guidance for affected customers centres on applying vendor fixes and a CPU information update. For VMs, users should install their OS vendor’s patch when released and, once the patched guest kernel is running, stop and start the VM (reboot alone is not enough). Bare-metal users should apply OS or hypervisor fixes when available, and rerun the same CPU-information update for patched guests.

For Google Kubernetes Engine (GKE), updated Turin-based node images will be supplied and node upgrades should obtain the CPU information update; Cloud Run requires no action. A kernel commit mitigating TSA on Zen 5, including the new variant, exists in the Linux kernel, with Debian’s unstable branch having CVE-2026-0004 fixed; other Debian and Ubuntu kernels remain vulnerable in older releases. AMD notes full mitigation may impact performance and urges administrators to weigh risks.