Google Cloud warns three AMD Turin CPU flaws could leak data across VMs

Summary

Google Cloud said three AMD Turin CPU side-channel flaws, all Transient Scheduler Attacks, could let an attacker with code on the same core infer data from other processes or the kernel inside a VM. Google has applied mitigations against attacks between VMs and between VMs and the host, while customers need a guest OS patch and a stop-and-start; no exploitation has been reported by Google or AMD.

What to do

• Install your OS vendor's kernel fix for the Turin CPU flaws when it ships.

• Stop and start VMs after the CPU information update reaches them, since a guest reboot is not enough.

• On your own Turin servers, apply both platform firmware and OS updates.

Timeline

1. Nov 12, 2026, 12:09 PM UTCMade public by The Hacker News
2. Nov 12, 2026, 12:36 PM UTCFirst seen by cve.now
3. Nov 12, 2026, 12:36 PM UTCConfirmed as CVE-2024-36350

Evidence 1

1. Nov 12, 2026Press
   The Hacker News

   “Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.