Xen Project and AMD: Transient Scheduler Attacks (CVE-2024-36350, CVE-2024-36357, CVE-2026-0004)
The Xen Project has updated security advisory XSA-525 to address Transient Scheduler Attacks (TSA) on AMD Zen 5 processors and disclose a new TSA-Fill variant affecting x86 architectures.
CVE search metadata
CVE search record: CVE-2024-36350. Severity: medium. CVSS: 5.6. EPSS: 0.49%. KEV: no. Product: Zen 3 CPUs, Zen 4 CPUs, Zen 5 CPUs, Xen Hypervisor. Brief: Xen Project and AMD: Transient Scheduler Attacks (CVE-2024-36350, CVE-2024-36357, CVE-2026-0004). Brief link: https://feed.craftedsignal.io/briefs/2026-11-xen-transient-scheduler-attacks/
CVE search record: CVE-2024-36357. Severity: medium. CVSS: 5.6. EPSS: 0.36%. KEV: no. Product: Zen 3 CPUs, Zen 4 CPUs, Zen 5 CPUs, Xen Hypervisor. Brief: Xen Project and AMD: Transient Scheduler Attacks (CVE-2024-36350, CVE-2024-36357, CVE-2026-0004). Brief link: https://feed.craftedsignal.io/briefs/2026-11-xen-transient-scheduler-attacks/
CVE search record: CVE-2026-0004. KEV: no. Product: Zen 3 CPUs, Zen 4 CPUs, Zen 5 CPUs, Xen Hypervisor. Brief: Xen Project and AMD: Transient Scheduler Attacks (CVE-2024-36350, CVE-2024-36357, CVE-2026-0004). Brief link: https://feed.craftedsignal.io/briefs/2026-11-xen-transient-scheduler-attacks/
Triage facts
Revision 1- Applicability
- Zen 3 CPUs, Zen 4 CPUs +2
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 4 public sources
- Freshness
- Revision 1Nov 11, 03:38 UTC
- Vulnerabilities
- 3 CVEs
- Source quality
- A1Roughly even chance
The Xen Project, in coordination with AMD, has updated XSA-525 to provide information on Transient Scheduler Attacks (TSA). Previous assessments regarding Zen 5 CPUs have been corrected, confirming vulnerability to TSA-SQ and TSA-L1 variants (tracked under CVE-2024-36350 and CVE-2024-36357). Additionally, a new variant designated as TSA-Fill has been disclosed, tracked as CVE-2026-0004. These transient execution vulnerabilities may allow unauthorized information disclosure.
Impact
Transient Scheduler Attacks leverage transient execution to potentially leak sensitive information across privilege boundaries within the hypervisor or between virtual machines.
Recommendation
- Inventory infrastructure running Xen Hypervisor on AMD Zen 3, Zen 4, and Zen 5 processor architectures.
- Review AMD Security Bulletin AMD-SB-7073 and AMD-SB-3055 for microcode and mitigation requirements.
- Apply updated microcode and hypervisor patches provided by your server hardware vendor and the Xen Project as they become available to address these TSA variants.
Immediate actions
Identify all Xen host systems utilizing AMD Zen 3, 4, or 5 CPUs.
Mitigations
Apply relevant microcode updates from hardware vendors identified in AMD-SB-7073 and AMD-SB-3055.
CVE-2024-36350, CVE-2024-36357, CVE-2026-0004