---
title: Google Cloud: AMD Turin side-channel bugs affect C4D, N4D, H4D, Z4D and G4 VMs; patch the guest, then stop and start (a reboot isn't enough) | ctxsec
url: https://ctxsec.com/items/gcp-2026-081-amd-epyc-turin-tsa-cve-2026-0004-c4d-n4d-h4d-z4d-g4-stop-start
description: "AMD disclosed three Transient Scheduler Attack issues on 5th-gen EPYC (Turin): CVE-2024-36350 (TSA-SQ) and CVE-2024-36357 (TSA-L1), previously disclosed for older EPYC parts, and new CVE-2026-0004 (L1 data cache). Code on the same core could infer data from another process, the kernel, another VM or the host. Google says it has mitigated VM-to-VM and VM-to-host attacks; protecting processes inside a VM requires a patched guest kernel plus updated CPU information that Google began rolling out Nov 10, which only takes effect after a stop and start."
status: "official (Google Cloud bulletin GCP-2026-081, Nov 10, 2026; AMD-SB-7073 / AMD-SB-3055); Google rates Medium"
published: 2026-11-12
---

> AMD disclosed three Transient Scheduler Attack issues on 5th-gen EPYC (Turin): CVE-2024-36350 (TSA-SQ) and CVE-2024-36357 (TSA-L1), previously disclosed for older EPYC parts, and new CVE-2026-0004 (L1 data cache). Code on the same core could infer data from another process, the kernel, another VM or the host. Google says it has mitigated VM-to-VM and VM-to-host attacks; protecting processes inside a VM requires a patched guest kernel plus updated CPU information that Google began rolling out Nov 10, which only takes effect after a stop and start.

[← Cybersecurity News](/news) · [markdown](/items/gcp-2026-081-amd-epyc-turin-tsa-cve-2026-0004-c4d-n4d-h4d-z4d-g4-stop-start.md)

official (Google Cloud bulletin GCP-2026-081, Nov 10, 2026; AMD-SB-7073 / AMD-SB-3055); Google rates Medium

2026-11-12 7:40 AM ET

### Google Cloud: AMD Turin side-channel bugs affect C4D, N4D, H4D, Z4D and G4 VMs; patch the guest, then stop and start (a reboot isn't enough)

- **Do now:** install guest OS fixes as vendors ship them, then stop/start (not reboot) affected VMs. Bare-metal and nested-virtualization users apply their own hypervisor/OS vendor fixes.
- **GKE:** new node images for Turin bare metal are coming; upgrading nodes picks up the CPU info change. Cloud Run needs no action.
- Other clouds and on-prem Turin hosts: check AMD-SB-7073 and your hypervisor vendor.

Sources: [Google Cloud security bulletin GCP-2026-081 (Nov 10, 2026)](https://docs.cloud.google.com/support/bulletins)