GPUThor: New Rowhammer attack lands a host root shell on four Nvidia RTX workstation cards

Nvidia spent the past year telling workstation buyers that turning on System-Level ECC was the answer to Rowhammer-class attacks on its GPUs. A paper accepted at ACM CCS 2026 from the University of Toronto shows that answer no longer holds for four named Ampere cards: the RTX A4000, A4500, A5000, and A6000. The researchers call their attack GPUThor, and it produces multi-bit memory flips that single-error-correct ECC cannot catch. In their demonstration, an unprivileged CUDA program on the target GPU escalates into a root shell on the host.

Rowhammer is a long-studied class of memory tampering: an attacker repeatedly activates one row of dynamic random-access memory (DRAM) until electrical leakage flips bits in adjacent rows. On CPUs, the technique has been public since 2015 and has been used through browsers and across virtualization boundaries. For GPU memory, the worry has been quieter. GDDR6 has a built-in defense called Target Row Refresh (TRR) that vendors credit with absorbing rowhammer-style accesses before they can flip a bit. ECC adds a second layer by detecting and correcting single-bit errors on the fly. Nvidia's public Rowhammer guidance has leaned on both, telling workstation operators that enabling System-Level ECC closes the gap.

GPUThor adapts a CPU technique called non-uniform hammering, originally built by the same broader research community to defeat the TRR pattern on commodity DRAM, and applies it to the way GPUs schedule memory accesses. The first problem is that a GPU groups memory requests inside a single warp (a 32-thread bundle that runs in lockstep), so the team had to find patterns that defeat memory request coalescing. The second is the GDDR6 refresh schedule itself. On the four tested cards, the researchers report that TRR likely fires only about once every 72 refresh intervals, and they built a six-interval hammering pattern that slips between those firings. The result is a hammering primitive that reaches the rows ECC is supposed to protect.

With ECC disabled, the paper reports between 72,000 and 377,000 bit flips per gigabyte across the four cards, with the A5000 the most exposed. According to The Hacker News' read of the data, the A5000 hit 377,552 flips per GB, roughly 23,597 times the 16 flips per GB the same group reported in its 2025 GPUHammer work, and about 500 times the rate of an earlier GPU Rowhammer attack called GDDRHammer.

ECC does not vanish in the new data. With System-Level ECC enabled on a locally owned A6000, the researchers report that one bank of hammering produced 11 detectable but uncorrectable errors (called DUEs) and one silent data corruption (an SDC) over a day of operation, averaging roughly one DUE every two hours. Each DUE aborts every running kernel on the GPU until the system is reset. The single SDC, in turn, is the path that can escalate the unprivileged CUDA program into a host root shell.

The escalation chain the team demonstrates runs through the GPU's own page tables. The unprivileged CUDA kernel uses the bit flips to corrupt page-table entries stored in GPU memory, then a second kernel reads or writes outside the boundaries its process is supposed to see. With the host IOMMU (input-output memory management unit, the chip-level filter that blocks devices from touching arbitrary host memory) enabled, a triple-bit flip in the right entry yields a host root shell. With the IOMMU disabled, a double-bit DUE, which the OS still has to log, is enough to give the attacker a host-side privilege escalation by repointing a page-table entry at CPU memory.

The threat model is local, not remote. Mounting GPUThor requires the ability to launch an unprivileged CUDA kernel on the target GPU, which means either a co-tenant on a shared card in a multi-tenant cloud, or untrusted code running locally on a single-tenant workstation. There is no browser or network primitive; the GPU itself is the entry point. The cards in scope are the four Ampere GDDR6 workstation parts the researchers owned and tested. Newer Ada and Blackwell workstation cards are not in the disclosed test set.

This is the third public Rowhammer-class hit on Nvidia workstation memory from broadly the same research group in about 18 months, after GPUHammer in 2025 and GPUBreach earlier in 2026. Each round has narrowed what the previous mitigation actually bought. The researchers' own operating guidance is conservative: avoid cross-tenant GPU sharing, monitor ECC error counters, and restrict untrusted CUDA workloads. For a single-user AI workstation, that last point has a practical edge: keep credentials, source code, SSH keys, and cloud tokens off any machine that runs untrusted CUDA. Nvidia's Rowhammer security notice is the place to watch for an updated position. As of publication, the page returned a "technical difficulties" response to automated reads, so a direct vendor response to GPUThor had not been confirmed at the time of writing.