# GPUThor: New Rowhammer Attack Breaks ECC Protection on NVIDIA Workstation GPUs
## A New Frontier in GPU Vulnerabilities
A team of academic researchers has revealed a sophisticated Rowhammer-style attack targeting NVIDIA workstation GPUs equipped with GDDR6 memory. Named GPUThor, this exploit bypasses the error correction codes (ECC) that NVIDIA has long recommended as the primary defense against memory-based attacks on graphics processors. The vulnerability enables both denial-of-service conditions and full privilege escalation to a root shell on the host system.
## How GPUThor Works
The attack exploits a weakness in how NVIDIA GPUs handle memory refresh cycles on Ampere-class workstation cards. Rather than activating aggressor and decoy rows at similar rates—a technique used in earlier GPU Rowhammer exploits—GPUThor employs a non-uniform hammering strategy. In this approach, the row adjacent to the victim row is activated far more frequently than surrounding decoy rows, effectively evading the GPU’s Target Row Refresh (TRR) defense mechanism.
The researchers discovered that memory accesses grouped within a single warp—a set of 32 threads executed in lockstep—get consolidated into a single DRAM activation at the memory controller level. However, accesses originating from different warps targeting different cache lines within the same row remain distinct and can be individually directed. This behavior allows GPUThor to precisely concentrate write activity on targeted memory banks.
Additionally, the team found that the TRR mechanism on the affected GDDR6 modules likely triggers approximately once every 72 refresh intervals rather than after each interval. Using this knowledge, they designed a six-interval pattern that aligns with the refresh schedule to maximize bit-flip propagation.
## GPUs Affected
The following NVIDIA workstation GPUs were confirmed vulnerable after testing:
– **RTX A6000** (48 GB GDDR6)
– **RTX A5000** (24 GB GDDR6)
– **RTX A4500** (20 GB GDDR6)
– **RTX A4000** (16 GB GDDR6)
The RTX A5000 proved to be the most susceptible card, registering **377,552 bit flips per gigabyte**—more than 23,000 times the rate observed in the team’s earlier GPUHammer exploit, and nearly 500 times the output of the previously strongest GPU Rowhammer attack, GDDRHammer.
Importantly, the attack produced no measurable bit flips on other NVIDIA components tested, including GPUs using GDDR6X, HBM2e, or newer-generation GDDR6 architectures. This suggests the vulnerability is tied to specific memory controller and refresh implementations particular to the A4000 through A6000 product line.
## ECC Failure and Silent Data Corruption
The single-error-correct, double-error-detect (SECDED) ECC architecture on these GPUs can correct a single flipped bit and flag two corrupted bits in a protected memory chunk. GPUThor uncovered a critical flaw: when three bits are flipped in a single protected segment, the ECC logic applies an incorrect correction—leading to silent data corruption (SDC) without alerting the system.
With ECC disabled across the four tested cards, campaigns generated between 72,000 and 377,000 bit flips per gigabyte. At a 16-byte granularity, the research uncovered 387 double-bit flips and two triple-bit flips distributed across the tested hardware. The A5000 alone accounted for 306 double-bit flips and both triple-bit flips.
When ECC was enabled on a locally owned RTX A6000, one bank of sustained hammering produced 11 detectable uncorrectable errors and one instance of silent data corruption over a 24-hour period—an average of one uncorrectable error every two hours. Each uncorrectable error terminates all running kernels on the card, rendering it inoperable until a manual reset.
## Privilege Escalation and Root Access
The researchers extended GPUThor’s impact beyond simple denial-of-service by achieving full host-level privilege escalation. The attack chain repurposes techniques from prior GPU-based exploits targeting the GPU’s page table mappings.
The process begins by manipulating page tables into a vulnerable memory row. Adjacent rows are then hammered to corrupt the page-frame number stored in a page table entry. A subsequent kernel execution leverages this tampered entry to access memory outside the intended process boundary.
Tri-bit silent data corruption enabled root access on the host even with the Input/Output Memory Management Unit (IOMMU) active. Double-bit uncorrectable errors allowed host-side privilege escalation on systems where IOMMU was disabled. In this scenario, the corrupted page table entry redirects the process toward CPU-managed memory, where the attacker overwrites the credential structure to assume root privileges.
The researchers noted that double-bit uncorrectable errors remain exploitable because NVIDIA GPUs handle these faults lazily—creating an approximately 10-millisecond window between error detection and GPU termination during which the corrupted data is still consumed by the attacker’s running kernel.
Locating exploitable multi-bit errors without triggering uncorrectable errors took approximately four days on the A6000. Nevertheless, an end-to-end privilege escalation achieved on that card took 21.9 hours initially but was dramatically reduced to 1.1 minutes once optimized attack patterns were applied—whether using the team’s original GPUHammer configurations or their newer GPUThor patterns.
## Mitigation Recommendations
The research team advises several immediate protective measures:
– **Avoid cross-tenant GPU sharing** in multi-user environments where untrusted workloads could be executed alongside privileged ones.
– **Monitor ECC error counters** regularly for anomalous error rates that may indicate ongoing Rowhammer-style exploitation.
– **Restrict untrusted CUDA workloads** on GPUs used in sensitive or multi-tenant compute environments.
Despite the demonstrated bypass of ECC, the researchers emphasized that enabling it “still raises the bar and remains worth enabling,” but it should no longer be relied upon as a standalone defense.
## Looking Ahead
GPUThor was responsibly disclosed to NVIDIA on April 29, 2026, and simultaneously reported to Google, Microsoft, and Amazon Web Services. An embargo period held until August 25, 2026, during which NVIDIA issued a security notice with recommended guidance. Full technical details are scheduled for public release on November 15, 2026, at the ACM Conference on Computer and Communications Security.
As of the most recent reporting, no CVE identifier has been assigned, no active exploitation in the wild has been documented, and no software patch directly addresses the vulnerability. The researchers noted that a comprehensive fix would demand stronger multi-bit error correction mechanisms and enhanced in-DRAM memory defenses—such as Refresh Management or Per-Row Activation Counting—in future GPU generations. Server-class Ampere GPUs and newer models feature Error Containment and Dynamic Page Offlining, which localize faults to the triggering application, but these safeguards still depend on SECDED-level ECC and may remain susceptible to SDC-based escalation. Similarly, RAS Repair found on some Blackwell family GPUs makes the DUE-based attack path more time-consuming but does not eliminate it entirely.
—
## Frequently Asked Questions
**Q1: What is Rowhammer, and why is it relevant to GPUs?**
A1: Rowhammer is a hardware vulnerability in dynamic random-access memory (DRAM) where repeatedly accessing specific memory rows causes electrical interference that flips bits in adjacent rows. While traditionally associated with server-class DDR4 and DDR5 memory, GPUThor demonstrates that the same physical phenomenon applies to GDDR6 memory used in graphics processors, opening an entirely new attack surface.
**Q2: Which NVIDIA GPUs are vulnerable to GPUThor?**
A2: The four Ampere-class workstation GPUs confirmed vulnerable are the RTX A6000 (48 GB), RTX A5000 (24 GB), RTX A4500 (20 GB), and RTX A4000 (16 GB), all utilizing GDDR6 memory. GPUs using GDDR6X, HBM2e, or newer GDDR6 implementations in different architectures were not affected.
**Q3: Does enabling ECC on my NVIDIA GPU protect me from GPUThor?**
A3: ECC provides a meaningful layer of defense and significantly reduces reliable exploitation, but it is no longer sufficient on its own. GPUThor exploits a flaw in the SECDED ECC implementation that allows silent data corruption when three bits are flipped in a memory segment, bypassing detection and correction. ECC should still be enabled, but it must be treated as part of a broader security strategy.
**Q4: Can GPUThor be exploited remotely over a network?**
A4: Mounting the attack requires the ability to launch an unprivileged CUDA kernel on the target GPU, either as a co-tenant sharing the same GPU or by running untrusted code on a single-tenant machine. While remote code execution prerequisites are strict, organizations running multi-tenant GPU clusters or containers that schedule untrusted workloads should treat this as a realistic threat.
**Q5: Is there a fix or patch available?**
A5: No software patch currently addresses GPUThor. A permanent fix would require hardware-level redesigns including stronger multi-bit error correction and physical in-DRAM defenses like Refresh Management or Per-Row Activation Counting, which NVIDIA may introduce in future GPU generations.
**Q6: Has GPUThor been exploited in the wild?**
A6: No. There have been no reports of in-the-wild exploitation as of the most current available information. The vulnerability operates under controlled laboratory conditions requiring sustained, targeted memory hammering over extended periods.
**Q7: What should enterprises do right now?**
A7: Enterprises should avoid sharing GPU resources between tenants running untrusted code, monitor ECC error logs for unusual patterns, restrict which users and processes can launch CUDA kernels on shared hardware, and consider isolating sensitive workloads on newer-generation GPUs that use different memory architectures not affected by this attack.
—
## Conclusion
GPUThor represents a significant advancement in hardware-level attacks targeting graphics processors. By uncovering subtle weaknesses in how GDDR6 memory refreshes and error correction interact under sustained stress, the researchers have demonstrated that the GPU attack surface is far from mature or well-understood. The findings underscore the growing importance of memory integrity protections not just for CPUs, but throughout the entire system stack. As GPU computing becomes more pervasive in cloud environments, scientific computing, and AI workloads, the ecosystem must invest in stronger hardware defenses and more sophisticated monitoring to stay ahead of these evolving threats.
Thank you for reading
