Google Cloud Warns of AMD Turin CPU Vulnerabilities
Three transient scheduler flaws in AMD Turin processors require urgent patching and system restarts.
1Three New CPU Flaws
Google Cloud has identified three distinct transient scheduler attacks affecting AMD Turin processors, the fifth-generation EPYC chips. These vulnerabilities, classified as side-channel flaws, could potentially allow an attacker to infer sensitive data from other processes or the kernel. The security issue impacts specific machine series including C4D, N4D, H4D, Z4D, and G4 instances.
2Transient Scheduler Attack Mechanisms
The identified flaws include TSA-SQ, TSA-L1, and a newly discovered variant labeled CVE-2026-0004. While the first two were initially disclosed in July 2025 for older EPYC processors, AMD confirmed that Zen 5 architecture is impacted differently. The new variant specifically allows attackers to infer data directly from the processor's L1 data cache.
3Required Mitigation Steps
To address these security risks, Google Cloud mandates that customers apply guest operating system patches and perform a full stop-and-start cycle for their virtual machines. This process ensures that the necessary microcode updates are properly initialized. Google notes that these mitigations are essential to protect data integrity between different virtual machine instances.
4Xen Project Hypervisor Patches
The Xen Project has released specific hypervisor patches to mitigate these vulnerabilities. According to their advisory, the required microcode for all identified TSA flaws on Zen 5 processors has been available in the linux-firmware repository since September 23. Administrators are encouraged to review these updates to secure their underlying server infrastructure effectively.
5Linux Kernel Patch Status
A kernel commit designed to mitigate TSA on Zen 5 is currently present in the Linux kernel source tree. However, distribution support remains fragmented. For instance, Debian has only implemented the fix for CVE-2026-0004 in its unstable branch, leaving stable versions like bookworm and trixie currently listed as vulnerable to these specific threats.
6Performance and Risk Assessment
AMD advises that fully mitigating these flaws requires both platform firmware and operating system updates. Administrators must carefully evaluate the potential performance impact these security patches may have on their specific workloads. Balancing the necessity of system security against operational performance requirements remains a critical decision point for data center and cloud infrastructure managers.
7Current Exploitation Landscape
As of the latest reports, none of the three identified flaws are included in the Known Exploited Vulnerabilities catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency. Neither Google nor AMD has reported any active exploitation of these vulnerabilities in the wild, suggesting the threat remains theoretical for most standard cloud deployments.
8Future Security Outlook
The discovery of these flaws highlights the ongoing challenges in securing modern processor architectures against side-channel attacks. As Zen 5 processors become more widely adopted, continuous monitoring of security bulletins from both hardware vendors and cloud providers is essential. Organizations should prioritize identity visibility and threat readiness to mitigate risks from emerging hardware-level vulnerabilities.
Original article: The Hacker News — Google Cloud Warns of AMD Turin CPU Vulnerabilities