🟡 Medium | Source: GCP Compute Engine Security Bulletins
A vulnerability in select Arm processors allows an attacker with privileged guest kernel access to prevent TLB (Translation Lookaside Buffer) invalidations from taking effect, potentially exposing sensitive data they should not be able to read. The flaw affects Google Cloud Compute Engine Arm-based VM families C4A and A4X. Google has already patched its Arm server fleet, so no action is required from customers.
Security Architect’s Take: No immediate action is required as Google has already deployed mitigations across its Arm infrastructure. However, architects running sensitive workloads on Arm-based GCE instances (C4A, A4X) should note this as a reminder to review guest kernel privilege boundaries and ensure least-privilege principles are enforced within VM environments to limit exposure from future similar vulnerabilities.
Original advisory: GCP-2026-004