Tip: for CPU side-channel fixes in the cloud, a guest reboot often isn't enough; stop and start the VM
- Check after restart that the kernel reports the TSA mitigation as active (for Linux, under
/sys/devices/system/cpu/vulnerabilities/).
Sources: Google Cloud security bulletin GCP-2026-081 (Nov 10, 2026)