Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Swati KhandelwalNov 12, 2026Vulnerability / Cloud Security Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week. The company has already applied mitigations against attacks between VMs, and between VMs and the host. Inside a VM, the flaws may let an attacker with code on the same processor core infer data from other processes or the kernel. The affected machine series are C4D, N4D, H4D, Z4D,, and G4, including bare-metal instances of C4D and Z4D. Turin is the code name for fifth-generation AMD EPYC processors. All three flaws are Transient Scheduler Attacks (TSA). Two of them, TSA-SQ (CVE-2024-36350) and TSA-L1 (CVE-2024-36357), were first disclosed on July 8, 2025, for earlier EPYC processors. AMD now says its Zen 5 processors, which include Turin, are "impacted differently from previously characterized AMD processors." The third flaw, CVE-2026-0004, is new. It may let an attacker who can run code on a system infer data in the processor's L1 data cache. The Xen Project, which maintains the Xen hypervisor, calls the new flaw TSA-Fill. It also says an earlier statement has been corrected: "AMD had previously said that Zen5 CPUs were not vulnerable to TSA-SQ and TSA-L1." Google rates the issue Medium. AMD classifies all three as local attacks with high attack complexity that require only low privileges, according to its Zen 5 bulletin and CVE-2026-0004 advisory. As of today, none of the three is in the KEV catalog of exploited flaws kept by the U.S. Cybersecurity and Infrastructure Security Agency. Neither company reports any exploitation in its bulletins. Google's security bulletin gives these steps for each service: VMs: Install your OS vendor's fix when it ships. Starting this week, the company will update the CPU information that VMs report, so a patched guest kernel can turn on its mitigations. After that update reaches a VM, stop and start it. As the company puts it: "Rebooting the guest OS isn't enough." Bare metal instances: If you run your own OS or hypervisor on a C4D or Z4D bare metal instance, apply your vendor's fixes when they are available. Hypervisors inside a VM: The same CPU information update applies, so patched guest kernels can turn on their mitigations. Stop and start the VM once the update arrives. GKE: Updated node images for Turin-based bare metal instances will be made available, and upgrading nodes picks up the CPU information update. As of today, the bulletin does not yet list them as available. Customers on older Rome, Milan, and Genoa processors got the same stop-and-start instruction in an earlier bulletin at the time of the original disclosure on July 8, 2025. The company lists nothing to do in the meantime for VMs whose OS vendor has not yet shipped a fix. It also does not say how to tell when the CPU information update has reached a VM. A kernel commit that mitigates TSA on Zen 5, including the new variant, is in the Linux kernel source tree. As of today, Debian has fixed CVE-2026-0004 in its Linux kernel only in its unstable branch. Its security tracker still lists the kernels in bookworm, trixie, and forky as vulnerable. For Turin servers on your own hardware, AMD says both platform firmware and OS updates are needed to mitigate the flaws fully. The mitigation may affect performance, and administrators should weigh the risk to their own workloads, according to its technical guidance. The Xen Project has published hypervisor patches in its Xen advisory. It says microcode for all TSA flaws on Zen 5 has been in linux-firmware since September 23. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cloud security, hardware security, Linux security, Virtualization, Vulnerability Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access The Flood is Coming And The Pipes Were Already Full CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk