Researchers at the University of Toronto have uncovered a new Rowhammer-style attack dubbed GPUThor that bypasses NVIDIA’s ECC protections on certain workstation GPUs, enabling denial-of-service (DoS) and root-level privilege escalation attacks. The vulnerability impacts specific RTX A-series cards using GDDR6 memory, and exposes a serious risk for systems relying chiefly on ECC as a safeguard.
Which GPUs are Impacted, and How It Works
GPUThor was tested on four NVIDIA Ampere-based workstation GPUs: RTX A6000 (48 GB), A5000 (24 GB), A4500 (20 GB), and A4000 (16 GB), all equipped with GDDR6 memory. Under attack, these cards exhibited bit flips—and in many cases double- or triple-bit errors—even when ECC was enabled. Alone among NVIDIA’s product line, server-class GPUs and cards using GDDR6X or HBM memories did not show signs of vulnerability under these specific exploit patterns. GPUThor’s technique is distinct for using non-uniform hammering: one aggressor row is activated much more frequently than adjacent “decoy” rows, circumventing defenses like Target Row Refresh (TRR) that assume more balanced activation patterns.
Severity: Bit Flips, Silent Errors, and Privilege Escalation
With ECC disabled, the attack triggered anywhere from ~72,000 to ~377,000 bit flips per gigabyte of memory. The A5000 was hit hardest, with about 377,552 flips/GB—far more than earlier Rowhammer attacks, including GPUHammer and GDDRhammer, and approaching the scale of an earlier DRAM-focused attack known as Blacksmith. Double-bit and triple-bit errors were observed at 16-byte granularity.
Even with ECC turned on, the RTX A6000 was not safe. Over 24 hours of sustained hammering, one DRAM bank produced multiple detectable uncorrectable errors (DUEs) and at least one silent data corruption (SDC). Every DUE forces all kernels on the GPU to abort until reset, meaning the card becomes unusable in the interim. The attack achieves root escalation by corrupting page table entries, allowing access to system memory or host credentials. Triple-bit SDCs enabled root access even with IOMMU enabled; double-bit DUEs suffice for host-level privilege escalation when IOMMU is disabled. Researchers found a brief ~10 ms window after DUE detection but before the GPU is killed that allows exploitation.
Scope, Mitigations, and What NVIDIA is Saying
The flaw was confirmed to affect only specific GPUs. Tests on NVIDIA A10, L4, L40 (GDDR6), as well as RTX 4090 (GDDR6X) and A30 (HBM2e), showed no bit flips under GPUThor’s attack pattern. Still, even newer devices using ECC remain at risk of SDC-based escalation if vulnerabilities are exploited before error containment systems intervene. NVIDIA was informed on April 29, 2026, along with other major vendors, under an embargo that expired August 25. A public security advisory has now been issued, but no software patch is currently available. The researchers recommend long-term defenses include more robust multi-bit ECC and in-DRAM protections like refresh management or per-row activation counting.
The researchers plan to publicize the full exploit code on November 15, 2026, coinciding with a major security conference where the GPUThor paper will be presented. So far, no reports of real-world exploitation or a CVE identifier have emerged.
Why this matters: Error-correcting code (ECC) has been a foundational defense against combination hardware-software attacks like Rowhammer. GPUThor shows that those protections aren’t foolproof—especially on GPU memory where assumptions about activity patterns, refresh schedule, and controller behavior can be exploited. In shared or multi-tenant GPU environments, untrusted workloads running CUDA kernels could become launchpads for far more serious host attacks. Users should enable ECC where available, monitor ECC error counters, avoid sharing GPUs across tenants, and press vendors to build in stronger in-DRAM defenses. Keep an eye out for NVIDIA’s future hardware revisions—whether Blackwell or successors—if they include built-in immunity to non-uniform hammering and true multi-bit correction.
