---
title: Tip: for CPU side-channel fixes in the cloud, a guest reboot often isn't enough; stop and start the VM | ctxsec
url: https://ctxsec.com/items/tip-amd-turin-tsa-stop-start-vm-after-guest-patch-reboot-not-enough
description: "For the AMD Turin TSA issues, Google says patched guest kernels only enable mitigations once the VM sees updated CPU information, which requires a full stop and start. Patch the guest, then schedule a stop/start for C4D, N4D, H4D, Z4D and G4 instances."
status: "official guidance (Google Cloud bulletin GCP-2026-081, Nov 10, 2026)"
published: 2026-11-12
---

> For the AMD Turin TSA issues, Google says patched guest kernels only enable mitigations once the VM sees updated CPU information, which requires a full stop and start. Patch the guest, then schedule a stop/start for C4D, N4D, H4D, Z4D and G4 instances.

[← Tips & Guides](/tips) · [markdown](/items/tip-amd-turin-tsa-stop-start-vm-after-guest-patch-reboot-not-enough.md)

official guidance (Google Cloud bulletin GCP-2026-081, Nov 10, 2026)

2026-11-12 7:40 AM ET

### Tip: for CPU side-channel fixes in the cloud, a guest reboot often isn't enough; stop and start the VM

- Check after restart that the kernel reports the TSA mitigation as active (for Linux, under `/sys/devices/system/cpu/vulnerabilities/`).

Sources: [Google Cloud security bulletin GCP-2026-081 (Nov 10, 2026)](https://docs.cloud.google.com/support/bulletins)