Vulnerability
Transient Scheduler Attacks
On AMD Zen 3 and Zen 4, the timing of loads that complete early can reveal data from older stores or from the L1 data cache across privilege boundaries.
- Also known as
- TSA
- Kind
- Transient execution
- CVEs
- 4
- Published
- 2025
- Linux reports it in
tsa
CVEs
| CVE | Name | Vendors | Published |
|---|---|---|---|
| CVE-2024-36348 | TSA: control registers (described below) | AMD | 2025-07-08 |
| CVE-2024-36349 | TSA: TSC_AUX (described below) | AMD | 2025-07-08 |
| CVE-2024-36350 | Transient Scheduler Attack on the store queue (TSA-SQ) | AMD | 2025-07-08 |
| CVE-2024-36357 | Transient Scheduler Attack on the L1 cache (TSA-L1) (described below) | AMD | 2025-07-08 |
How to check a machine
On Linux, /sys/devices/system/cpu/vulnerabilities/tsa reports it; the kernel’s documentation lists the lines it can hold.
CVEs without a page of their own
The sources give these CVEs too few facts of their own (affected processors, a mitigation, a check) for a page; this is what they say.
CVE-2024-36348: TSA: control registers
A user process can infer control register values speculatively even with UMIP on; AMD plans no fix, as these values are not sensitive. AMD-SB-7029. Source. CVE record (2025-07-08).
CVE-2024-36349: TSA: TSC_AUX
A user process can infer TSC_AUX even when reading it is disabled; AMD plans no fix, as the value is not sensitive. AMD-SB-7029. Source. CVE record (2025-07-08).
CVE-2024-36357: Transient Scheduler Attack on the L1 cache
The same timing leak as TSA-SQ, revealing data in the L1 data cache; AMD lists the same processors and the same fixes for both. AMD-SB-7029. Source. CVE record (2025-07-08).
Advisories
AMD-SB-7029: AMD Transient Scheduler Attacks
CVE-2024-36350, CVE-2024-36357, CVE-2024-36348, CVE-2024-36349