GPU researchers bypass NVIDIA’s ECC with GPUThor Rowhammer
Academic researchers have disclosed GPUThor, a Rowhammer attack that defeats error-correcting code on NVIDIA workstation GPUs with GDDR6 memory and enables denial-of-service and root-shell access.
Source: The Hacker News · August 27, 2026 at 10:31 AM · AI-assisted report
Single-source
KUALA LUMPUR, 27 AUGUST 2026 —
Academic researchers have disclosed GPUThor, a Rowhammer attack that defeats error-correcting code on NVIDIA workstation GPUs with GDDR6 memory and enables denial-of-service and root-shell access.
Market Impact
The team from the University of Toronto said they induced 377,552 bit flips per gigabyte on an RTX A5000—23,597 times the rate recorded in their earlier GPUHammer attack—by non-uniformly hammering four DRAM banks for 24 hours each. The A5000’s error rate reached roughly 500 times the 758 flips per gigabyte reported for GDDRHammer, the strongest prior GPU Rowhammer variant.
Mounting the attack needs only the ability to launch an unprivileged CUDA kernel on the target GPU, either on a shared card or a single-tenant machine, the researchers said. NVIDIA’s July 2025 security notice already advised enabling system-level ECC to mitigate Rowhammer, and the Toronto team confirmed that ECC reduces but does not eliminate risk.
With ECC enabled on a locally owned RTX A6000, one day of hammering produced 11 detectable uncorrectable errors and one silent-data-corruption event, each forcing a full GPU reset.
To escalate privileges, the researchers reused exploit code from their GPUBreach page-table attack. They first massaged page tables into a vulnerable memory row, then hammered neighboring rows to corrupt a page-frame number. A second kernel then accessed host memory outside the process sandbox. Using a triple-bit error, they obtained root with the IOMMU enabled; with a double-bit error and no IOMMU, they still achieved host-side privilege escalation.
NVIDIA’s error-handling delays a 10 ms window between detection and GPU kill, during which corrupted data can be consumed by the attacker’s kernel.
GPUThor’s hammering pattern exploits TRR’s weak refresh cadence—about once every 72 intervals—and distributes memory accesses within single warps to merge commands at the DRAM controller, bypassing in-DRAM defenses. Across four Ampere-class cards, the method produced 387 double-bit flips and two triple-bit flips at 16-byte granularity with ECC disabled. The A5000 accounted for 306 double-bit and both triple-bit events.
The researchers tested additional NVIDIA GPUs—including A10, L4, L40, RTX 4090 and A30—and found no bit flips, attributing the difference to varied TRR implementations in newer memory types. Server parts such as the A100 and H100 were not in the sample, and the team noted that even Blackwell GPUs’ RAS Repair only makes double-error routes slower without removing them.
GPUThor was disclosed to NVIDIA on April 29 2026 and to Google, Microsoft and AWS under embargo until August 25 2026. As of August 27 2026 no in-the-wild exploitation has been reported and no public patch exists.