GPUThor Rowhammer Attack Bypasses ECC on NVIDIA GPUs

Aug 26, 2026 · Original article ↗

Summary

University of Toronto researchers say GPUThor evades TRR on tested NVIDIA Ampere GPUs, producing ECC errors, denial of service and a claimed root-level privilege escalation. NVIDIA recommends ECC, IOMMU/DMA isolation and workload restrictions.

Key points

GPUThor uses a non-uniform memory-hammering pattern designed to avoid triggering GDDR6 Target Row Refresh (TRR), accounting for undocumented GPU memory-request behavior.
On tested Ampere workstation GPUs with GDDR6, researchers measured 72,000–377,000 bit flips per GB without ECC—up to 23,597 times GPUHammer's reported rates.
With ECC enabled, the researchers observed uncorrectable double-bit errors and triple-bit errors that ECC repaired incorrectly, causing data corruption.
Researchers induced repeated resets and workload termination on an ECC-enabled RTX A6000; they also claim corrupted GPU page tables can enable arbitrary memory access and a root shell on the host.
The researchers say privilege escalation may also work on server-class Ampere A100 GPUs. RAS Repair on some Blackwell GPUs increases attack time but does not prevent it.
NVIDIA recommends enabling SYS-ECC and IOMMU/DMA isolation, monitoring GPU error telemetry, and restricting untrusted workloads; the researchers also advise avoiding cross-tenant GPU sharing where possible.
NVIDIA said results vary by memory and system configuration; the attack patterns produced no observed bit flips on tested GDDR6X or HBM2e GPUs.

Article Details

Attack Vectors: GPUThor uses a non-uniform Rowhammer pattern on GPU memory to evade GDDR6 Target Row Refresh mitigations and cause bit flips despite ECC protections.
Researchers demonstrated denial of service on an ECC-enabled RTX A6000, causing GPU resets that terminate workloads.
Researchers reported that corrupting GPU page tables can give an unprivileged CUDA program arbitrary memory access and enable root-level privilege escalation on the host.
Defensive Notes: NVIDIA recommends enabling SYS-ECC and IOMMU/DMA isolation, monitoring GPU error telemetry, and restricting the sharing or execution of untrusted workloads.
The researchers recommend avoiding cross-tenant GPU sharing where possible, monitoring ECC error counters, and restricting untrusted CUDA workloads.
NVIDIA said risk varies by memory device, technology, platform design, in-DRAM defenses, and system configuration; the researchers reported no bit flips on the tested GDDR6X or HBM2e GPUs using the same attack patterns.