Rowhammer Attack Breaks NVIDIA GPU Security, Enables Root Access

Academic researchers have revealed a Rowhammer attack called GPUThor that defeats the error correction codes NVIDIA recommends as protection against GPU Rowhammer exploits, allowing attackers to crash workstation graphics cards and gain root-level system control. Developed by a team at the University of Toronto, the technique was disclosed August 25, 2026, following a coordinated embargo with NVIDIA, Google, Microsoft, and AWS. The attack works on NVIDIA Ampere-class workstation GPUs equipped with GDDR6 memory, even when error correction is turned on, and requires only the ability to run an unprivileged CUDA kernel on the target card—either as a co-tenant sharing the GPU or as untrusted code on a single-user machine.

The researchers tested four NVIDIA RTX workstation cards—the A6000 with 48 GB GDDR6, the A5000 with 24 GB, the A4500 with 20 GB, and the A4000 with 16 GB—by hammering four memory banks for 24 hours each and inducing bit flips on all four. With error correction disabled, the campaigns generated between 72,000 and 377,000 bit flips per gigabyte across the four cards. The RTX A5000 proved most vulnerable at 377,552 flips per gigabyte, roughly 23,597 times the 16 flips per gigabyte achieved by GPUHammer, the team's earlier work, and about 500 times the 758 flips per gigabyte reported for GDDRHammer, the strongest prior GPU Rowhammer demonstration. At a 16-byte granularity, the tests turned up 387 double-bit flips and two triple-bit flips across the four cards with error correction off, with the A5000 responsible for 306 of the double-bit flips and both triple-bit flips. With error correction enabled on a locally owned RTX A6000, one bank of hammering produced 11 detectable, uncorrectable errors and one silent data corruption event over 24 hours, averaging one detectable error every two hours. Each detectable error kills all kernels running on the card, rendering it unusable until reset. The researchers achieved end-to-end privilege escalation that took 21.9 hours on the A6000, and completed it in 1.1 minutes using both GPUHammer's patterns and GPUThor's patterns.

The University of Toronto team noted that GPUThor introduces non-uniform hammering, in which the aggressor row adjacent to the victim is activated far more frequently than the decoy rows used to overwhelm the memory's Target Row Refresh defense. According to the researchers, they found that Target Row Refresh on these GDDR6 parts likely applies approximately once every 72 refresh intervals instead of once per interval, and they constructed a six-interval pattern around that schedule. The single-error-correct, double-error-detect error correction on these GPUs corrects one flipped bit in a protected chunk and detects two, but the team discovered it mis-corrects three, resulting in silent data corruption. "Moreover, we discover that even double-bit DUEs are exploitable, since DUEs are serviced lazily in NVIDIA GPUs, leaving a ~10 ms time window between DUE detection and the GPU being killed, during which the corrupted data is consumed by the attacker's GPU kernel," the researchers stated. NVIDIA said in a July 2025 security notice that enabling System-Level ECC mitigates the Rowhammer problem, following the team's earlier GPUHammer work, which was neutralized once error correction was enabled.

GPUThor was reported to NVIDIA on April 29, 2026, and the company released a security notice with guidance at the embargo's conclusion, though no patch addresses the attack and no CVE identifier has been assigned. The researchers said a complete fix would require stronger multi-bit error correction and in-DRAM defenses, such as Refresh Management or Per-Row Activation Counting, in future GPUs. The attack code is scheduled for public release on November 15, 2026, at the ACM Conference on Computer and Communications Security, where the paper will be presented. As of August 27, 2026, no in-the-wild exploitation has been reported. The same patterns produced no bit flips on other NVIDIA parts tested, including an A10, an L4, and an L40 on GDDR6, an RTX 4090 on GDDR6X, and an A30 on HBM2e, likely due to differing Target Row Refresh implementations. The researchers recommend avoiding cross-tenant GPU sharing, monitoring error correction counters, and restricting untrusted CUDA workloads, and they noted on the GPUThor project site that "ECC still raises the bar and remains worth enabling, but it can no longer be treated as a sufficient defense." The disclosure marks a sharp escalation in the threat model for shared GPU infrastructure, where the economics of multi-tenant compute have long assumed hardware-level isolation would contain malicious code within its assigned partition.