Google Cloud addresses transient scheduler attacks on AMD Turin processors - SC Media
Google Cloud virtual machines using fifth-generation AMD EPYC Turin processors require guest OS patches and a full stop-and-start cycle to mitigate three Transient Scheduler Attacks.
The vulnerabilities include two previously disclosed flaws and a new issue identified as CVE-2026-0004. These flaws may allow an attacker with code execution on the same processor core to infer sensitive data from other processes or the kernel.
Affected Systems
Affected machine series include C4D, N4D, H4D, Z4D and G4. While Google has already implemented mitigations to prevent cross-VM attacks, users must update their guest kernels once patches become available.
Required Actions
A simple reboot is insufficient; administrators must stop and start their instances to ensure the updated CPU information is applied. AMD notes that Zen 5 processors are impacted differently than earlier generations, and full mitigation requires both platform firmware and operating system updates.
Performance impacts may occur following the application of these fixes, requiring administrators to evaluate the risks to their specific workloads.
Official Response
Although the Cybersecurity and Infrastructure Security Agency has not added these flaws to its known exploited vulnerabilities catalog, users are encouraged to monitor vendor security bulletins for further guidance.
Related
