Google Cloud warned on November 12 that three Transient Scheduler Attack flaws affect AMD EPYC Turin processors and can leak data between processes running inside a virtual machine. Google rates the issues Medium and says it has already mitigated the risk of leakage between VMs and from a VM to the host.
Three TSA Flaws Reach AMD Zen 5
The bulletin covers three issues: TSA-SQ (CVE-2024-36350), TSA-L1 (CVE-2024-36357) and a new flaw, CVE-2026-0004, known as TSA-Fill, which involves inference from the L1 data cache. The first two were originally disclosed on July 8, 2025 for older EPYC processors.
AMD now says Zen 5, the architecture behind Turin, is affected differently. That corrects an earlier AMD statement that Zen 5 was not vulnerable to TSA-SQ and TSA-L1.
Attack Conditions and Google’s Severity Rating
The attacks are local, require high complexity and need only low privileges, and Google rates them Medium. No exploitation has been reported and none of the flaws is in the CISA Known Exploited Vulnerabilities catalog.
Affected Google Cloud VM Families
The Turin-based machine families named in the bulletin are C4D, N4D, H4D, Z4D and G4. Google has already put protections in place that stop one VM from reading another VM’s data and stop a VM from reading the host’s.
Protecting Processes Inside a Single VM
Isolation within a VM is a customer-side task. To protect processes running inside one VM, customers need to apply a guest operating system patch and stop and start the VM. Google’s mitigations at the platform level do not cover that boundary.
Kernel, Firmware and Distribution Status
A Linux kernel mitigation commit exists. Debian has fixed CVE-2026-0004 only in its unstable branch so far. Microcode for the flaws has been in linux-firmware since September 23.
Firmware Needs for On-Premises AMD Turin Servers
Organizations that run Turin hardware on their own premises need firmware updates in addition to operating system updates. The mitigations may carry a performance cost, according to the bulletin.
The advisory shows how long a hardware vulnerability class can keep producing new findings. The TSA family was first disclosed in July 2025, and the November bulletin extends it to a processor generation that AMD had earlier described as unaffected for two of the flaws. The correction matters for customers who relied on the earlier statement when assessing their fleet.
For cloud users, the cross-tenant risks sit with the provider, which has already acted. The remaining exposure is between processes inside the same VM, where a low-privileged local attacker could attempt to infer data from another process. That scenario matters most for VMs that run multiple workloads or that host untrusted code alongside sensitive services, and it is the case that requires guest patching and a VM restart to close.
Disclosure Timeline for the Turin Correction
The original TSA disclosure for older EPYC processors came on July 8, 2025. The November bulletin from Google Cloud is the first public statement that applies the family of flaws to Turin, and it comes with the reversal of AMD’s earlier position on Zen 5. Customers who tracked Turin as unaffected in their risk registers need to update that status.
Debian and Linux Distribution Coverage for CVE-2026-0004
Distribution support is uneven. The kernel mitigation commit exists, microcode has been available through linux-firmware since September 23, and Debian has so far fixed CVE-2026-0004 only in its unstable branch, which leaves stable-release users waiting on their distribution for the fix.
What Cloud Customers Should Confirm
Google’s bulletin leaves a small set of customer tasks: confirm which of the C4D, N4D, H4D, Z4D and G4 families they run, install the guest operating system patch, and stop and start the affected VMs so the mitigation takes effect. Teams that also operate Turin hardware outside Google Cloud need to plan firmware and operating system updates together.
