Academic researchers have disclosed a new Rowhammer attack, dubbed GPUThor, that targets NVIDIA workstation GPUs with GDDR6 memory and defeats the error correction codes (ECC) that NVIDIA had previously recommended as the primary mitigation against GPU Rowhammer. The attack enables denial-of-service (DoS) and can escalate privileges to a root shell, marking a significant escalation in the threat landscape for shared GPU environments. Developed by researchers at the University of Toronto, GPUThor subjects four DRAM banks to 24 hours of hammering each on four Ampere-class NVIDIA cards, successfully inducing bit flips on every single one.
What GPUs Are Vulnerable to GPUThor?
The following NVIDIA workstation GPUs were tested and found vulnerable to the GPUThor attack:
- RTX A6000 (48 GB GDDR6)
- RTX A5000 (24 GB GDDR6)
- RTX A4500 (20 GB GDDR6)
- RTX A4000 (16 GB GDDR6)
All four cards use GDDR6 memory and are part of the Ampere architecture. The attack requires the ability to launch an unprivileged CUDA kernel on the target GPU, either as a co-tenant on a shared card or as untrusted code on a single-tenant machine. The researchers advise avoiding cross-tenant GPU sharing, monitoring ECC error counters, and restricting untrusted CUDA workloads as mitigations.
How GPUThor Breaks NVIDIA’s Recommended ECC Mitigation
NVIDIA had previously stated that enabling System-Level ECC neutralizes Rowhammer problems on their GPUs. In a July 2025 security notice, the company wrote: “Recently, researchers at the University of Toronto demonstrated a successful Rowhammer exploitation on an NVIDIA A6000 GPU with GDDR6 memory where System-Level ECC was not enabled. In the same paper, the researchers showed that enabling System-Level ECC mitigates the Rowhammer problem.” However, GPUThor directly challenges that assertion. The researchers found that with ECC enabled on a locally owned RTX A6000, one bank of hammering produced 11 detectable, uncorrectable errors (DUE) and one silent data corruption (SDC) over a day — an average of one DUE every two hours. Each DUE aborts all kernels running on the card, leaving it unusable until a reset.
Non-Uniform Hammering: The Key to Bypassing TRR
The critical innovation in GPUThor is non-uniform hammering. Unlike prior GPU Rowhammer attacks, which activated aggressor and decoy rows at roughly the same rate, GPUThor activates the aggressor row next to the victim far more often than the decoy rows used to swamp the memory’s Target Row Refresh (TRR) defense. The researchers discovered that repeated accesses issued inside a single warp — the group of 32 threads a GPU runs in lockstep — are merged at the memory controller into a single DRAM activation. Accesses issued from different warps to different cache lines within the same row survive as separate activations, and the hammering kernels distribute them accordingly.
They also reported in the GPUThor paper that TRR on these GDDR6 parts likely applies about once every 72 refresh intervals rather than once per interval, and built a six-interval pattern around that schedule to maximize the probability of bit flips while avoiding detection.
Bit Flip Rates: A Dramatic Increase Over Prior Attacks
Across the four cards, the GPUThor campaigns produced 72,000 to 377,000 bit flips per gigabyte with ECC disabled. The RTX A5000 was the most susceptible at 377,552 flips per gigabyte — that is 23,597 times the 16 flips per gigabyte achieved by GPUHammer, the first GPU Rowhammer attack demonstrated on NVIDIA hardware, and roughly 500 times the 758 flips per gigabyte reported for GDDRHammer, the strongest prior GPU Rowhammer attack. The paper places the A5000 rate close to the roughly 550,000 flips per gigabyte reached by Blacksmith, which established non-uniform hammering on DDR4 as a route past in-DRAM defenses.
At a 16-byte granularity, the campaigns turned up 387 double-bit flips and two triple-bit flips across the four cards with ECC disabled. The A5000 alone accounted for 306 of the double-bit flips and both triple-bit flips.
How ECC Fails: Silent Data Corruption and Exploitable DUEs
The single-error-correct, double-error-detect (SECDED) ECC on these GPUs corrects one flipped bit in a protected chunk and detects two. The researchers found that it mis-corrects three, resulting in silent data corruption (SDC). With ECC enabled, the RTX A6000 produced one SDC per day of hammering. More critically, the researchers discovered that even double-bit detectable, uncorrectable errors (DUEs) are exploitable. “DUEs are serviced lazily in NVIDIA GPUs, leaving a ~10 ms time window between DUE detection and the GPU being killed, during which the corrupted data is consumed by the attacker’s GPU kernel,” the researchers said.
Privilege Escalation to Root Shell
For the escalation itself, the researchers reused the exploit code from GPUBreach, their earlier GPU page-table privilege escalation research. Page tables are first massaged into a vulnerable row. The neighboring rows are then hammered to corrupt the page-frame number of an entry. A second kernel reaches memory outside the process through the tampered entry. Using the triple-bit SDC, the researchers obtained root on the host with the IOMMU enabled. Using a double-bit DUE, they achieved host-side privilege escalation on systems where the IOMMU is disabled. A page-table entry is repointed at CPU memory, and the process credential structure is then overwritten.
Locating exploitable multi-bit errors without setting off a DUE took about four days on the A6000. An end-to-end privilege escalation that took 21.9 hours on that card was completed in 1.1 minutes with GPUHammer’s patterns and in 1.1 minutes with GPUThor’s.
Which GPUs Remain Unaffected?
The same patterns produced no bit flips on the other NVIDIA parts tested, including an A10, an L4, and an L40 on GDDR6, an RTX 4090 on GDDR6X, and an A30 on HBM2e. “We also tested other memory types (see Appendix D), including HBM, GDDR6X, and newer-generation GDDR6 on NVIDIA GPUs, and did not observe any bit flips on them. This is likely due to differing TRR implementations in these memories compared to the A4000-A6000 GPUs, which make GPUThor’s patterns unsuccessful,” the researchers said. The A100 and H100 were outside the tested set.
Timeline of Disclosure and Mitigation
GPUThor was reported to NVIDIA on April 29, 2026, and to Google, Microsoft, and AWS. The findings were subject to an embargo that ran until August 25, 2026. NVIDIA released a security notice with guidance at the end. GPUThor does not carry a CVE identifier, and no in-the-wild exploitation has been reported as of August 27, 2026. No patch addresses the attack, and the researchers said a complete fix would require stronger multi-bit error correction and in-DRAM defenses, such as Refresh Management or Per-Row Activation Counting, in future GPUs. The attack code is due for public release on November 15, 2026, the opening day of the ACM Conference on Computer and Communications Security, where the paper will be presented.
Implications for Server-Class and Future GPUs
Server-class Ampere GPUs and newer carry Error Containment and Dynamic Page Offlining, which confine a fault to the triggering application, but they still rely on SECDED-level ECC, and the researchers said an SDC-based escalation could still work against them. RAS Repair on some Blackwell GPUs makes the DUE-based route more time-consuming without preventing it. The Hacker News contacted NVIDIA for comment on whether ECC remains a sufficient mitigation and the University of Toronto researchers for further detail; neither had responded by publication. As the researchers state on the GPUThor project site: “We used these to crash GPUs and to escalate privileges with ECC enabled. ECC still raises the bar and remains worth enabling, but it can no longer be treated as a sufficient defense.”
The practical takeaway for organizations using NVIDIA RTX A-series GPUs in multi-tenant or shared environments is clear: ECC alone is no longer a reliable safeguard. Administrators should consider disabling GPU sharing for untrusted workloads, closely monitor ECC error counters, and prepare for the public release of the attack code in November 2026. The GPUThor research underscores a broader trend: as DRAM densities increase and Rowhammer attacks become more sophisticated, hardware-level defenses must evolve beyond the current SECDED paradigm, especially in accelerators used for AI, rendering, and scientific computing where data integrity is paramount.
