NVIDIA GPUs Vulnerable to GPUThor Rowhammer Attack Bypassing ECC

377,552 bit flips per gigabyte: that was the peak corruption rate the University of Toronto researchers recorded on an NVIDIA RTX A5000 when they ran their new GPUThor Rowhammer technique against GDDR6 memory.

What the University of Toronto researchers demonstrated

Researchers at the University of Toronto disclosed GPUThor, a Rowhammer-style attack that induces large numbers of DRAM bit flips on Ampere-class NVIDIA workstation cards with GDDR6 memory. The cards tested and found vulnerable were the RTX A6000 (48 GB GDDR6), RTX A5000 (24 GB GDDR6), RTX A4500 (20 GB GDDR6) and RTX A4000 (16 GB GDDR6). Across those four cards, the campaigns produced between 72,000 and 377,000 bit flips per gigabyte with ECC disabled; the A5000 was the most susceptible at 377,552 flips per gigabyte.

How GPUThor bypasses in-DRAM defenses and ECC

GPUThor builds on prior GPU Rowhammer work by using non-uniform hammering: aggressor rows adjacent to the victim are activated far more often than decoy rows used to swamp the memory controller’s Target Row Refresh (TRR) defenses. The researchers describe how accesses issued inside a single warp are merged by the memory controller into a single DRAM activation, while accesses from different warps to different cache lines within the same row survive as separate activations. They also report TRR on these GDDR6 parts likely applies only about once every 72 refresh intervals rather than once per interval, and they constructed a six-interval pattern around that schedule.

With ECC disabled, the researchers observed 387 double-bit flips and two triple-bit flips at 16-byte granularity across the four cards, with the A5000 accounting for 306 of the double-bit flips and both triple-bit flips. The single-error-correct, double-error-detect (SECDED) ECC on these GPUs corrects one flipped bit and detects two, but the team found instances where ECC mis-corrected three flipped bits, producing silent data corruption (SDC).

From bit flips to host root: the exploitation chain and impact

The researchers reused exploit code from their GPUBreach page-table work to convert memory corruption into host privilege escalation. They first massaged page tables into a vulnerable row, hammered neighboring rows to corrupt a page-frame number, then used a second kernel to reach CPU memory through the tampered entry. Using a triple-bit SDC, they obtained root on the host even with the IOMMU enabled. Using a double-bit DUE they achieved host-side privilege escalation on systems where the IOMMU is disabled by repointing a page-table entry to CPU memory and overwriting a process credential structure.

The researchers also noted that NVIDIA GPUs service detectable, uncorrectable errors (DUEs) lazily, leaving roughly a 10 ms window between DUE detection and the GPU being killed. That window can allow corrupted data to be consumed by an attacker’s GPU kernel; locating exploitable multi-bit errors without setting off a DUE took about four days on the A6000. A single bank of hammering with ECC enabled on a locally owned RTX A6000 produced 11 DUEs and one SDC over a day—an average of one DUE every two hours—and each DUE aborts all kernels on the card until a reset, creating a denial-of-service condition. The team reports an end-to-end privilege escalation that previously took 21.9 hours on that card was completed in 1.1 minutes with GPUHammer’s patterns and in 1.1 minutes with GPUThor’s.

Vendor response, testing scope, and disclosure timeline

The researchers reported GPUThor to NVIDIA and to cloud providers Google, Microsoft, and AWS on April 29, 2026, and the findings were embargoed until August 25, 2026. NVIDIA’s July 2025 security notice about the team’s earlier GPUHammer work stated, "Recently, researchers at the University of Toronto demonstrated a successful Rowhammer exploitation on an NVIDIA A6000 GPU with GDDR6 memory where System-Level ECC was not enabled. In the same paper, the researchers showed that enabling System-Level ECC mitigates the Rowhammer problem." The University of Toronto team said NVIDIA released a security notice with guidance at the end of the embargo period.

The researchers also tested other NVIDIA parts and memory types with no observed flips: an A10, an L4, and an L40 on GDDR6; an RTX 4090 on GDDR6X; and an A30 on HBM2e. The A100 and H100 were not part of the tested set. The paper notes server-class Ampere GPUs and newer include Error Containment and Dynamic Page Offlining, which confine a fault to the triggering application, but that those devices still rely on SECDED-level ECC and "an SDC-based escalation could still work against them." The researchers said RAS Repair on some Blackwell GPUs makes the DUE-based route more time-consuming without preventing it.

What this means for technologists, cloud providers, and enterprises

• Technologists and security teams: monitor ECC error counters closely and treat ECC as raising the bar rather than as a complete defense; the researchers advised restricting untrusted CUDA workloads.
• Cloud providers and shared-GPU operators: avoid cross-tenant GPU sharing or apply stricter isolation, since mounting the attack requires the ability to launch an unprivileged CUDA kernel on the target GPU.
• Enterprises with locally owned workstations: enable System-Level ECC where available and be aware that DUEs abort all kernels and can produce denial-of-service even when ECC is enabled.

No CVE identifier had been assigned to GPUThor as of August 27, 2026, and the researchers said a complete fix will require stronger multi-bit error correction and in-DRAM defenses such as Refresh Management or Per-Row Activation Counting in future GPUs. The team plans to release the attack code on November 15, 2026, at the ACM Conference on Computer and Communications Security. As the authors put it on the GPUThor project site: "We used these to crash GPUs and to escalate privileges with ECC enabled. ECC still raises the bar and remains worth enabling, but it can no longer be treated as a sufficient defense."

Original reporting: thehackernews.com: GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access