Meta News

Security researchers have demonstrated a new Rowhammer attack against NVIDIA workstation GPUs that can bypass error-correcting memory protections and, under certain conditions, escalate an unprivileged GPU workload to root access on the host system.

The attack, named GPUThor, was developed by researchers at the University of Toronto and targets Ampere-generation NVIDIA GPUs equipped with GDDR6 memory. The researchers successfully induced memory bit flips on four workstation cards: the RTX A6000, A5000, A4500 and A4000. More importantly, they demonstrated that enabling ECC—the protection previously recommended by NVIDIA against GPU Rowhammer—is no longer sufficient to completely prevent exploitation.

Rowhammer is a hardware attack that exploits the physical behavior of DRAM. By repeatedly accessing specific memory rows at extremely high frequency, an attacker can cause electrical interference that changes bits stored in neighboring rows. Those changes can corrupt information the attacker would normally have no permission to modify.

GPUThor builds on GPUHammer, earlier research from the same University of Toronto team that demonstrated Rowhammer attacks against NVIDIA GPUs. GPUHammer could produce roughly 16 bit flips per gigabyte on an RTX A6000, but enabling system-level ECC effectively neutralized the attack.

GPUThor substantially increases the effectiveness of the technique by using non-uniform hammering. Instead of accessing aggressor and decoy memory rows at similar rates, the new method concentrates substantially more activity on the rows immediately surrounding its target. This allows it to interfere more effectively with Target Row Refresh (TRR), a DRAM defense designed to detect and protect memory rows exposed to suspiciously frequent access.

The improvement is dramatic. With ECC disabled, researchers produced between 72,000 and 377,000 bit flips per gigabyte across the four affected cards. The RTX A5000 proved particularly vulnerable, reaching 377,552 flips per gigabyte—more than 23,000 times the rate previously demonstrated by GPUHammer.

The most important result came when researchers repeated their experiments with ECC enabled.

The affected NVIDIA GPUs use SECDED—single-error correction, double-error detection. It can automatically repair a single corrupted bit and detect when two bits have changed. GPUThor, however, demonstrated that sufficiently aggressive Rowhammer patterns can produce multi-bit errors that exceed those capabilities.

During a 24-hour experiment on an ECC-enabled RTX A6000, researchers recorded 11 detectable but uncorrectable errors and one case of silent data corruption. Triple-bit corruption is especially problematic because the ECC implementation can incorrectly “repair” the data instead of recognizing that it has been corrupted.

That means ECC still makes exploitation substantially harder, but it can no longer be considered an absolute defense against GPU Rowhammer on the affected hardware.

The researchers then demonstrated why these bit flips matter beyond simply crashing GPU workloads.

GPUThor was combined with techniques from their earlier GPUBreach research to manipulate GPU page tables, the structures that determine which physical memory locations a process is allowed to access. The attackers first position a page-table entry inside vulnerable memory and then hammer neighboring rows until bits inside that entry change.

Once a page-table entry is corrupted in the right way, a malicious CUDA kernel can access memory outside its normal boundaries. Researchers used a triple-bit silent corruption to obtain root privileges on the host even with IOMMU enabled. They also demonstrated another privilege-escalation route using double-bit errors when IOMMU was disabled.

The researchers additionally discovered that NVIDIA GPUs do not immediately terminate workloads after detecting some uncorrectable ECC errors. There can be a window of roughly 10 milliseconds between detection and termination, during which corrupted information can still be consumed by a malicious kernel. That small delay was enough to make some otherwise fatal ECC errors exploitable.

GPUThor cannot be launched remotely against an arbitrary NVIDIA card. An attacker first needs the ability to execute an unprivileged CUDA kernel on the target GPU. That could occur when untrusted workloads are allowed on a workstation or, more significantly, when multiple customers share GPU resources in cloud or computing environments.

The researchers therefore recommend avoiding cross-tenant GPU sharing on affected hardware where possible, restricting execution of untrusted CUDA workloads and monitoring ECC error counters for unusual activity.

Not every NVIDIA GPU tested was vulnerable. The same attack patterns produced no bit flips on the A10, L4 and L40 using GDDR6, the RTX 4090 using GDDR6X or the A30 using HBM2e. The researchers did not test NVIDIA’s A100 or H100 accelerators, so the findings should not be generalized to those models.

GPUThor was disclosed to NVIDIA on April 29, 2026, as well as to Google, Microsoft and AWS. The coordinated disclosure embargo ended on August 25, and NVIDIA has released security guidance related to the research. No exploitation has been observed in the wild, and GPUThor currently has no CVE identifier.

More importantly, there is no conventional software patch that eliminates the underlying weakness. Rowhammer ultimately exploits physical characteristics of DRAM, and the researchers argue that comprehensive mitigation will require stronger multi-bit error correction combined with improved memory defenses such as Refresh Management or Per-Row Activation Counting in future GPU generations.

The GPUThor exploit code is scheduled for public release on November 15, 2026, when the research will be presented at the ACM Conference on Computer and Communications Security.

GPUThor is significant because GPUs are no longer peripheral devices used primarily for graphics. Modern AI infrastructure increasingly treats them as powerful shared computing environments capable of executing complex, user-supplied workloads while interacting closely with host memory.

That changes their security significance. A memory-corruption weakness inside a GPU can potentially cross the boundary into the operating system itself.

The research does not mean NVIDIA GPUs can suddenly be compromised remotely through Rowhammer, and exploitation requires substantial preparation and local CUDA execution. But it breaks an important assumption established after GPUHammer:ECC raises the barrier, but it cannot be relied upon as a complete defense against sophisticated GPU Rowhammer attacks.

⁠Original report at The Hacker News