GPUThor Rowhammer Attack Reaches Host Root on NVIDIA GPUs
Researchers at the University of Toronto have disclosed GPUThor, a Rowhammer technique affecting NVIDIA Ampere workstation GPUs with GDDR6 memory. The attack was demonstrated against the RTX A6000, RTX A5000, RTX A4500 and RTX A4000, and can cause denial of service or escalate privileges to a root shell on the host.
GPUThor requires an attacker to launch an unprivileged CUDA kernel on the target GPU. That could mean a co-tenant using a shared accelerator or untrusted code running on a single-tenant machine. NVIDIA said in a July 2025 security notice that System-Level ECC mitigated the Rowhammer issue demonstrated on an RTX A6000 when it was enabled.
Non-uniform hammering changes the attack pattern
The researchers tested four DRAM banks for 24 hours on each of four Ampere-class cards and induced bit flips on every card. With ECC disabled, campaigns generated between 72,000 and 377,000 bit flips per GB. The RTX A5000 was the most susceptible, at 377,552 flips per GB.
Unlike earlier GPU Rowhammer approaches, GPUThor uses non-uniform hammering. The row adjacent to a victim row is activated much more often than decoy rows intended to overwhelm the memory subsystem's Target Row Refresh, or TRR, protection. The team found that accesses within one 32-thread warp can be merged into one DRAM activation, while requests from different warps to distinct cache lines in the same row can remain separate activations.
The paper also reports that TRR on the affected GDDR6 parts appears to be applied around once every 72 refresh intervals. The researchers built a six-interval hammering pattern around that behaviour. Their testing found no bit flips with these patterns on an NVIDIA A10, L4 or L40 using GDDR6, an RTX 4090 using GDDR6X, or an A30 using HBM2e.
ECC limits errors but does not eliminate the risk
The GPUs use single-error-correct, double-error-detect ECC. It corrects one flipped bit in a protected chunk and detects two, but the researchers found that three-bit errors can be mis-corrected, leading to silent data corruption. At 16-byte granularity, the campaigns found 387 double-bit flips and two triple-bit flips across the four cards with ECC disabled.
On a locally controlled RTX A6000 with ECC enabled, one day of hammering on a bank generated 11 detectable, uncorrectable errors and one silent data corruption event. Each detectable error aborts all kernels on the card and leaves the GPU unusable until reset. The researchers nevertheless found that errors are handled lazily, leaving an approximately 10 ms interval between detection and termination in which a malicious kernel may consume corrupted data.
Privilege escalation path and operational response
For escalation, GPUThor reused code from the researchers' GPUBreach work. The process manipulates GPU page tables into a vulnerable row, hammers neighbouring rows to alter a page-frame number, and then uses a second kernel to access memory beyond the process boundary. Triple-bit silent corruption allowed host root access with the IOMMU enabled; double-bit detectable errors enabled host-side escalation where the IOMMU was disabled.
GPUThor was reported to NVIDIA on April 29, 2026, as well as to Google, Microsoft and AWS, before an embargo ending on August 25. It has no CVE identifier, no patch, and no reported in-the-wild exploitation. The researchers say a comprehensive remedy would require stronger multi-bit correction and in-DRAM defences such as Refresh Management or Per-Row Activation Counting in future hardware.
For organisations running shared or sensitive GPU workloads, the immediate implication is to avoid cross-tenant GPU sharing where possible, restrict untrusted CUDA kernels, enable System-Level ECC, and monitor ECC error counters rather than treating ECC as a complete isolation boundary.