Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs

Google Cloud has issued a security advisory regarding three CPU side-channel vulnerabilities in AMD's Turin (fifth-gen EPYC) processors that could allow data leakage across processes within virtual machines. The flaws are classified as Transient Scheduler Attacks (TSA): TSA-SQ (CVE-2024-36350), TSA-L1 (CVE-2024-36357), and a newly disclosed variant TSA-Fill (CVE-2026-0004). These vulnerabilities may enable an attacker with code execution on the same core to infer sensitive data from other processes or the kernel via the L1 cache. Google has applied host-level mitigations but requires customers to patch guest operating systems and perform a full stop-and-start of VMs to fully mitigate the risk.

AI-extracted · verify before operational use