CVE-2026-0004: AMD EPYC 5th generation processor data cache information leak

CVE-2026-0004 · Severity: high · Published 2026-11-10

AMD EPYC 5th generation processors (Turin) contain hardware vulnerabilities that allow attackers to infer sensitive data from processor caches and store queues. In Google Cloud, this could enable data theft across virtual machines or from the host hypervisor. Organizations running workloads on affected Compute Engine machine types (C4D, N4D, H4D, Z4D, G4) must update their guest operating systems to enable protective mitigations once OS vendors release patches.

Technologies: Google Cloud Platform. Vendors: Amd, Google.

Quick answers

Is CVE-2026-0004 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-0004 being exploited in the wild.
How severe is CVE-2026-0004?
High severity, published 10 November 2026.
Which products and versions are affected?
Amd EPYC 5th generation processor (Turin) 5th generation; Google Compute Engine C4D all; Google Compute Engine G4 all; Google Compute Engine H4D all; and 2 more.
Is there a fix for CVE-2026-0004?
No fixed version is recorded yet. Update your guest operating system to a version that includes patches for CVE-2024-36350, CVE-2024-36357, or CVE-2026-0004 when your OS vendor releases them. For VMs and nested virtualization scenarios, after the patch is installed, you must stop and start the VM (not merely reboot the guest OS) to allow the kernel to detect updated CPU information and enable its cache-based attack mitigations. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-0004 attacked?
It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-0004?
Check whether you run Amd EPYC 5th generation processor (Turin), Google Compute Engine C4D, Google Compute Engine G4 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Update your guest operating system to a version that includes patches for CVE-2024-36350, CVE-2024-36357, or CVE-2026-0004 when your OS vendor releases them. For VMs and nested virtualization scenarios, after the patch is installed, you must stop and start the VM (not merely reboot the guest OS) to allow the kernel to detect updated CPU information and enable its cache-based attack mitigations.

Technical details

Three CVEs (CVE-2024-36350, CVE-2024-36357, CVE-2026-0004) affect AMD EPYC Turin processors, allowing inference of data from the L1 data cache and store queue through side-channel attacks across privilege boundaries. Google has deployed hypervisor-level mitigations to protect inter-VM and VM-to-host attacks, but intra-VM attacks (process-to-process) require guest kernel patches. Remediation involves updating the guest OS when available and performing a VM stop/start (not a soft reboot) to allow the kernel to detect the updated CPU information and enable its mitigations.

Affected products

  • AMD EPYC 5th generation processor (Turin) 5th generation
  • Google Compute Engine C4D all
  • Google Compute Engine N4D all
  • Google Compute Engine H4D all
  • Google Compute Engine Z4D all
  • Google Compute Engine G4 all

Identifiers

  • CVE-2026-0004
  • CVE-2024-36350
  • CVE-2024-36357

Timeline

  • 2026-11-10: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.