🟠 High | Source: GCP Compute Engine Security Bulletins
Intel has disclosed two CPU vulnerabilities (CVE-2025-21090 and CVE-2025-22840) affecting Sapphire Rapids, Emerald Rapids, and Granite Rapids processors used in several GCP VM families. CVE-2025-21090 allows an unprivileged attacker to crash the host machine by exploiting AMX and AVX CPU instructions, whilst CVE-2025-22840 targets Granite Rapids-based VMs. Google will apply patches automatically during standard maintenance windows, and no exploitation has been observed.
Security Architect’s Take: No immediate action is required as Google is patching automatically, but architects running latency-sensitive or availability-critical workloads on affected VM families (C3, Z3, H3, A3, v5p, N4, C4, M4, A3 Ultra, A4) should review upcoming maintenance windows and ensure availability groups or multi-region deployments are in place to absorb any planned restarts.
Original advisory: GCP-2025-044