GPUThor Rowhammer Attack Bypasses ECC on NVIDIA RTX A6000 to Achieve Host Root Access

Academic researchers at the University of Toronto have disclosed a new Rowhammer attack, dubbed GPUThor, that defeats error correction codes (ECC) on NVIDIA workstation GPUs with GDDR6 memory. The attack enables denial-of-service (DoS) and privilege escalation to a root shell on the host system, bypassing the ECC mitigation that NVIDIA recommends against GPU Rowhammer.

The researchers hammered four DRAM banks for 24 hours each on four Ampere-class cards, inducing bit flips on all of them. The vulnerable GPUs include the RTX A6000 (48 GB GDDR6), RTX A5000 (24 GB GDDR6), RTX A4500 (20 GB GDDR6), and RTX A4000 (16 GB GDDR6). The attack requires the ability to launch an unprivileged CUDA kernel on the target GPU, either as a co-tenant on a shared card or as untrusted code on a single-tenant machine.

GPUThor introduces non-uniform hammering, where the aggressor row next to the victim is activated far more often than decoy rows, bypassing the memory’s Target Row Refresh (TRR) defense. The researchers found that repeated accesses issued inside a single warp are merged at the memory controller into a single DRAM activation, while accesses from different warps to different cache lines within the same row survive as separate activations. They also discovered that TRR on these GDDR6 parts likely applies about once every 72 refresh intervals, and built a six-interval pattern around that schedule.

Across the four cards, the campaigns produced 72,000 to 377,000 bit flips per gigabyte with ECC disabled. The RTX A5000 was the most susceptible at 377,552 flips per gigabyte, which is 23,597 times GPUHammer’s 16 flips per gigabyte and roughly 500 times the 758 flips per gigabyte reported for GDDRHammer. At a 16-byte granularity, the campaigns turned up 387 double-bit flips and two triple-bit flips across the four cards with ECC disabled. The single-error-correct, double-error-detect (SECDED) ECC on these GPUs corrects one flipped bit and detects two, but mis-corrects three, resulting in silent data corruption (SDC).

With ECC enabled on a locally owned RTX A6000, one bank of hammering produced 11 detectable, uncorrectable errors (DUE) and one SDC over a day, an average of one DUE every two hours. Each DUE aborts all kernels running on the card, leaving it unusable until a reset. The researchers reused exploit code from GPUBreach, their earlier GPU page-table privilege escalation research, to escalate privileges. Using the triple-bit SDC, they obtained root on the host with the IOMMU enabled. Using a double-bit DUE, they achieved host-side privilege escalation on systems where the IOMMU is disabled.

GPUThor was reported to NVIDIA on April 29, 2026, and to Google, Microsoft, and AWS. The findings were subject to an embargo until August 25, 2026. NVIDIA released a security notice with guidance. GPUThor does not carry a CVE identifier, and no in-the-wild exploitation has been reported as of August 27, 2026. No patch addresses the attack, and the researchers said a complete fix would require stronger multi-bit error correction and in-DRAM defenses, such as Refresh Management or Per-Row Activation Counting, in future GPUs. The attack code is due for public release on November 15, 2026, at the ACM Conference on Computer and Communications Security.