AMD / Google Cloud AMD EPYC Turin em… · Disclosed

[Single source] Google mitigates AMD Turin cross-VM flaws; guests require patching

Nov 12, 2026 · 1 min read

Three side-channel flaws in AMD Turin processors may let code on the same core infer data from other processes or the kernel. Google mitigated attacks between VMs and between a VM and its host. Customers should patch the guest OS and stop and restart their VMs.

By HIFY Radar newsroom Updated 11/12/2026 09:35 AM Get this every day →← Back to the feed 2 sources

HighVulnerabilityDisclosedPartial fix

In 30 seconds

Alleged

Google Cloud reportedly has mitigated attacks between virtual machines and between a VM and its host on AMD Turin systems. Customers still need to patch the guest operating system and stop and restart affected VMs to address exposure inside each VM.

What happened

Alleged

The Hacker News reports that three CPU side-channel flaws affect Google Cloud VMs using AMD Turin chips. According to the report, code running on the same processor core could infer information from other processes or the guest kernel.

Why it matters

Inferred

The mitigations appear to protect cloud isolation boundaries between separate VMs and the host, but they do not by themselves remove the risk among workloads inside one guest. That leaves customers responsible for completing protection within their own operating systems.

What to do

Alleged

Administrators of affected instances should apply the relevant guest OS patch, then stop and start the VM. The publisher's follow-up post specifically warns that an ordinary reboot is not sufficient.

Confirmed and still uncertain

Observed

The supplied evidence says three flaws are involved and describes their potential effect, but it does not identify them by vulnerability number, name affected operating systems, specify patch versions, or report whether attackers have exploited them in practice.

What people are saying

Observed

The Hacker News says the flaws could leak sensitive data inside VMs and emphasizes that customers must take action even after Google applied infrastructure-level mitigations.

Evolution

Alleged

The reported response has two layers: Google first applied protections against cross-VM and VM-to-host attacks, while the remaining in-guest exposure is being addressed through customer-installed OS patches followed by a full stop-and-start cycle.

Reach

Observed

1 independent groups, 2 updates, and 5 engagements.

Technical detail

Alleged

These are described as side-channel flaws, meaning an attacker would infer data from indirect processor behavior rather than read it through normal permissions. The scenario presented requires attacker-controlled code to share a processor core with another process or the kernel inside the VM.

Sources and evidence

Observed

The evidence consists of a brief The Hacker News article excerpt and a post from the publication's own X account. They provide consistent operational guidance, but they are not independent corroboration, and the supplied lot contains no direct Google or AMD advisory.