Academic researchers from the University of Toronto have disclosed GPUThor, a new Rowhammer attack targeting NVIDIA workstation GPUs equipped with GDDR6 memory. The research demonstrates that the technique can bypass Error Correction Code (ECC) protections, which NVIDIA has previously recommended as a mitigation against GPU based Rowhammer attacks. According to the researchers, GPUThor can be used to trigger denial of service conditions and, under specific circumstances, achieve privilege escalation to a root shell on the host system. The attack was successfully demonstrated on four Ampere based workstation GPUs, including the RTX A6000 with 48 GB of GDDR6 memory, RTX A5000 with 24 GB, RTX A4500 with 20 GB, and RTX A4000 with 16 GB. The researchers noted that executing the attack requires the ability to run an unprivileged CUDA kernel on the target GPU, either through shared GPU environments or by executing untrusted code on a system with direct GPU access.
GPUThor builds on previous GPUHammer research by introducing a non uniform hammering technique that focuses memory accesses on specific aggressor rows rather than distributing them evenly across memory. The researchers found that this approach significantly increases the likelihood of inducing memory bit flips while reducing the effectiveness of Target Row Refresh protections built into GDDR6 memory. During testing, the attack generated between 72,000 and more than 377,000 bit flips per gigabyte with ECC disabled, with the RTX A5000 proving to be the most susceptible among the tested hardware. Researchers also identified hundreds of double bit errors and multiple triple bit errors that exposed limitations in Single Error Correct Double Error Detect ECC protection. According to the study, triple bit errors can result in silent data corruption, while double bit errors can produce detectable but uncorrectable faults capable of interrupting GPU workloads. NVIDIA previously stated that enabling System Level ECC mitigates GPU Rowhammer attacks, but the latest research suggests that ECC alone is no longer sufficient as a complete defensive measure against this new attack technique.
To demonstrate the practical impact of GPUThor, the research team combined the attack with exploit methods previously developed during its GPUBreach research. By manipulating GPU page tables through induced memory corruption, the researchers demonstrated the ability to access memory beyond process boundaries and eventually obtain host root privileges. On systems with an Input Output Memory Management Unit enabled, privilege escalation was achieved through silent data corruption caused by triple bit errors. On systems without IOMMU protection, the researchers demonstrated a separate privilege escalation method using double bit detectable errors during the short period before GPU processes were terminated. The researchers explained that locating exploitable multi bit errors required several days of testing on an RTX A6000, while the complete privilege escalation process was successfully demonstrated after the required memory conditions had been established. Testing also showed that the same attack patterns did not produce bit flips on other NVIDIA hardware, including GPUs using GDDR6X or HBM memory, indicating that the vulnerability is currently limited to specific generations of GDDR6 equipped workstation GPUs.
The GPUThor findings were responsibly disclosed to NVIDIA on 29 April 2026 and shared with Google, Microsoft, and AWS before a coordinated disclosure on 25 August 2026. NVIDIA has issued security guidance recommending that organizations continue enabling System Level ECC where supported while monitoring ECC error counters, avoiding cross tenant GPU sharing, and restricting execution of untrusted CUDA workloads. The researchers also recommend limiting GPU sharing between unrelated workloads to reduce potential attack opportunities. At the time of publication, no in the wild exploitation has been reported and GPUThor has not been assigned a CVE identifier. The research concludes that future GPU architectures may require stronger multi bit error correction capabilities and additional in memory protection mechanisms to provide more comprehensive defenses against increasingly advanced Rowhammer based attacks.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
