GCP-2026-053

In plain language

What this advisory means

Google Cloud found multiple security problems in Intel Trust Domain Extensions (TDX) firmware that can affect Confidential Virtual Machines (VMs). Attackers with host control could bypass security checks, read protected registers, or decrypt secured guest memory. Google has proactively updated their servers with fixes, so most customers don't need to act unless specifically advised.

Technical explanation

How the issue affects the environment

Several vulnerabilities in Intel® Trust Domain Extensions (TDX) firmware can compromise Confidential VM guest integrity by allowing a privileged host adversary to bypass attestation, access restricted CPU registers, and decrypt confidential guest memory. These security flaws enable circumvention of TDX's protections designed for confidential computing, which guarantees confidentiality and integrity of guest workloads even from the host hypervisor. Google applied firmware upgrades across their server fleet to mitigate these exploits affecting Confidential VMs based on Intel TDX. There is no required action from customers unless directly notified for upgrades. Reference is made to Intel's PSIRT advisories INTEL-TA-01404, INTEL-TA-01428, INTEL-TA-01419, INTEL-TA-01439, INTEL-TA-01442, and INTEL-TA-01436.

Operational impact

Why teams should care

Confidential VM instances using Intel TDX technology risk data exposure and integrity compromise if affected by these vulnerabilities. Malicious host actors could bypass the cryptographic attestation mechanisms, access secrets or cryptographic keys, and violate tenant isolation. This undermines trust in confidential computing for sensitive workloads, potentially exposing regulated or proprietary data. Google's proactive remediation reduces customer risk and operational impact since no manual updates or downtime are generally required.

Affected and fixed releases

Temporary risk reduction

The official advisory does not specify any customer-side workarounds. Protection is provided by Google's proactive firmware deployment.

Evidence and validation checklist

• Official Google Cloud Security Bulletin GCP-2026-053 dated 2026-08-11
• Reference to Intel PSIRT advisories INTEL-TA-01404, INTEL-TA-01428, INTEL-TA-01419, INTEL-TA-01439, INTEL-TA-01442, INTEL-TA-01436
• Google discloses affected product scope as Confidential VM instances relying on Intel TDX
• Google states no customer action required unless separately advised
• Multiple CVEs listed associated with Intel TDX firmware vulnerabilities