GPUThor

Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs

ACM CCS 2026 The Hague · 15–19 November 2026

Chris S. Lin, Joyce Qu, Aditya Rajeev, and Gururaj Saileshwar

University of Toronto

📄 Read the Paper 💻 Code & Artifact (public 15 Nov 2026) 🎓 Cite this work 🛡️ NVIDIA Security Notice

Exploits Enabled by GPUThor:

• ECC, NVIDIA’s recommended defense, no longer holds. GPUThor induces 387 double-bit errors that ECC detects but cannot correct, and 2 triple-bit errors that ECC silently “repairs” into the wrong value.
• Denial of service, and GPUs declare themselves defective. On an A6000 with ECC enabled, GPUThor forces one GPU reset every 2 hours, killing every job running on the card; within a day, the GPU flags itself as due for replacement (RMA-ready).
• Privilege escalation to root, with ECC enabled. By corrupting GPU page tables, an unprivileged GPU program escalates all the way to a root shell on the host CPU, the first such system takeover on an ECC-protected GPU.

Background: Rowhammer on GPUs

#

DRAM stores each bit as charge in a cell, and cells are packed into rows that sit very close together. Rowhammer is a read-disturbance failure: repeatedly activating (“hammering”) one row leaks charge from the cells in adjacent rows and flips their bits. No permission to those neighboring rows is needed, which is what makes Rowhammer useful for data tampering, sandbox escapes, and privilege escalation. DRAM chips ship with an in-DRAM mitigation, Target Row Refresh (TRR): the chip samples frequently activated rows and issues a corrective refresh to their neighbors. Attacks evade TRR by mixing in decoy rows to overwhelm the sampler.

Our previous work, GPUHammer (2025), first demonstrated Rowhammer bit flips in the GDDR6 memory of NVIDIA GPUs, and follow-up work, GPUBreach (2026) showed the privilege escalation all the way to root shell on the CPU. At that time, NVIDIA recommended enabling ECC as a mitigation (NVIDIA Security Notice, 2025). All prior GPU attacks are defeated once ECC is enabled since they yield only tens to hundreds of flips per GB that can be corrected by the ECC on the NVIDIA GPUs; these bit flip rates are orders of magnitude below CPU attacks such as Blacksmith (≈550,000 flips/GB on DDR4).

What GPUThor does differently

#

Prior GPU attacks hammer uniformly: the aggressor row next to the victim is activated about as often as the decoys, so most of the effort lands on rows that do not matter. CPU attacks moved to non-uniform patterns years ago; no GPU attack had managed it. GPUThor enables non-uniform hammering on GPUs by overcoming two undocumented behaviors as follows.

Together these yield the attack pattern below: a 6-tREFI pattern sustaining ≈110,000 aggressor activations per refresh window, 6.6× the intensity of prior uniform GPU attack patterns.

Bit flips measured

#

Higher flip density also shortens the search for an exploitable flip. An end-to-end privilege-escalation exploit that takes 21.9 hours with GPUHammer patterns on an A6000 completes in 1.1 minutes with GPUThor.

Exploits

#

Affected GPUs

#

We evaluated four Ampere-class NVIDIA workstation GPUs with GDDR6 memory — cards widely used in AI workstations and in the cloud. All four are vulnerable to bit flips with our attack and an unprivileged CUDA kernel can exploit these to mount the attacks above.

Responsible disclosure

#

We reported this to NVIDIA prior to public disclosure

We disclosed GPUThor to NVIDIA on 29 April 2026, and also to the major cloud providers (Google, Microsoft, AWS). At NVIDIA's request, the work was held under embargo until 25 August 2026, when NVIDIA released a security notice with guidance.

Frequently asked questions

#

Mitigations

#

• Stronger error correction. Adopting stronger error correction codes that correct multi-bit errors (e.g., Chipkill-class ECC) can raise the bar for attacks, but add storage and bandwidth overheads on top of the 6.25% already spent on SECDED in GDDR6.
• Hardware defenses. Adopting more principled defenses in GPU memories, such as Refresh Management (RFM) and Per-Row Activation Counting (PRAC) proposed in DDR5, can address the root cause and make attacks like GPUThor substantially harder.
• Monitoring. Administrators can monitor corrected-error counts as the exploit may result in several single-bit errors that are corrected along the way. This is however an imperfect defense as triple-bit flips can induce silent data corruptions, leaving no observable traces.

Paper & citation

#

GPUThor appears at the ACM SIGSAC Conference on Computer and Communications Security (CCS ‘26), 15–19 November 2026, in The Hague, The Netherlands.

📄 Read the full paper (PDF) 💻 Code & Artifact

Our code and artifacts will be released publicly at github.com/sith-lab/gputhor on 15 November 2026.

@inproceedings{lin2026gputhor,
  author    = {Chris S. Lin and Joyce Qu and Aditya Rajeev and Gururaj Saileshwar},
  title     = {{GPUThor}: Amplifying Rowhammer Attacks via Non-Uniform Patterns
               to Exploit {ECC}-Protected {GPUs}},
  booktitle = {Proceedings of the 2026 ACM SIGSAC Conference on Computer and
               Communications Security (CCS '26)},
  year      = {2026},
  location  = {The Hague, The Netherlands},
  publisher = {ACM},
}

Acknowledgements

#

This research was supported by the Natural Sciences and Engineering Research Council of Canada (NSERC) and an NSERC–CSE Research Communities Grant. Any opinions expressed are solely those of the authors and do not represent the official views of the funding agencies or the Government of Canada.