University of Toronto researchers have developed a new Rowhammer technique named GPUThor that can overwhelm error-correcting memory on several NVIDIA workstation GPUs, enabling crashes and even privilege escalation to root.
The attack produces up to 23,500 times more bit flips than the first GPU Rowhammer attack, bringing GPU attack rates close to those seen on CPUs.
GPUThor was developed by Chris S. Lin, Joyce Qu, Aditya Rajeev, and Gururaj Saileshwar and will be presented at ACM CCS 2026 in The Hague in November. The researchers disclosed their findings to NVIDIA on April 29, 2026, as well as to Google, Microsoft, and AWS, and kept the work under embargo until NVIDIA published updated guidance in August.
Rowhammer exploits a physical property of DRAM where repeatedly accessing one memory row can disturb nearby cells enough to change stored bits. Modern memory uses Target Row Refresh (TRR) to detect heavily accessed rows, while NVIDIA's supported workstation GPUs can also use SECDED ECC, which corrects single-bit errors and detects double-bit errors.
NVIDIA is one of the largest GPU vendors, with its hardware widely deployed in workstations, AI infrastructure, cloud environments, and high-performance computing systems. GPUThor was tested against Ampere-generation RTX A4000, A4500, A5000, and A6000 workstation cards using GDDR6 memory.
The researchers found that previous GPU Rowhammer attacks wasted much of their effort by accessing attacker-controlled “aggressor” rows and decoy rows at roughly equal rates. GPUThor instead uses non-uniform patterns that hammer aggressor rows more frequently while retaining enough decoy activity to evade TRR.
Making this work required reverse-engineering two undocumented behaviors. GPUThor found that repeated accesses can be merged by the GPU memory subsystem, but accesses issued from different warps to different cache lines in the same row survive as separate DRAM activations. The team also determined that TRR mitigation on the tested Ampere GDDR6 devices appears roughly every 72 refresh intervals.
GPUThor consequently uses a six-refresh-interval pattern that reaches about 110,000 aggressor activations per refresh window, 6.6 times the intensity of earlier GPU attacks. Tests recorded between 72,000 and 377,000 bit flips per GB, with the RTX A5000 reaching the highest rate.
University of Toronto
That density is sufficient to defeat the tested ECC implementation. The researchers observed 387 double-bit errors that ECC could detect but not repair, plus two triple-bit errors that were incorrectly “repaired,” resulting in silent data corruption.
On an ECC-enabled A6000, GPUThor triggered an uncorrectable error, and the GPU reset about once every two hours. Repeated errors can exhaust the GPU's spare-row remapping capacity and cause it to flag itself for replacement.
More seriously, the researchers demonstrated root privilege escalation with ECC enabled by corrupting GPU page-table entries. Triple-bit errors can evade detection, while detected double-bit errors are handled lazily enough that the attacking kernel can briefly consume corrupted data before the GPU is terminated.
University of Toronto
NVIDIA says the research demonstrated flips on the four tested GDDR6 workstation GPUs but notes that no flips were observed on tested GDDR6X or HBM2e devices using the same patterns.
Administrators should keep SYS-ECC enabled but not treat it as a complete defense. NVIDIA also recommends enabling and verifying host IOMMU/DMA isolation, monitoring ECC errors, unexpected resets, and row-remapping events, and evaluating GPU tenancy and workload isolation. The researchers additionally recommend stronger multi-bit ECC and newer hardware defenses such as Refresh Management and Per-Row Activation Counting.
Leave a Reply