GPUThor Bypasses NVIDIA ECC: Root Escalation in 1.1 Minutes on Workstation GPUs

On August 25, 2026, a team from the University of Toronto disclosed GPUThor, a non-uniform Rowhammer attack that defeats SECDED ECC protection on NVIDIA Ampere workstation GPUs. In one year the vendor's stance has flipped: as of July 2025 NVIDIA considered ECC a sufficient mitigation, yet the same RTX A4000-A6000 cards remain unpatched with a practical exploit achieving host root in 1.1 minutes.

How Non-Uniform Hammering Tricks the NVIDIA Memory Controller

The mechanism relies on two undocumented behaviors of the Ampere workstation GPU memory controller. Repeated requests within a single warp are fused into a single DRAM activation, while accesses from different warps to different cache lines in the same row survive as separate activations. TRR on GDDR6 triggers roughly once every 72 refresh intervals, not every cycle.

Researchers built a six-interval pattern that concentrates activations on the aggressor row adjacent to the victim, bypassing the defense. With ECC disabled, the bit-flip range spans 72,000 to 377,000 per GB: the RTX A5000 peaks at 377,552 flips/GB, a multiplier of roughly 23,597x over the previous GPUHammer (16 flips/GB) and about 500x over GDDRHammer (758 flips/GB).

The same conditions produce 387 double-bit flips and 2 triple-bit flips at 16-byte granularity across all four tested cards. The RTX A5000 alone accounts for 306 double-bit and 2 triple-bit flips of the total.

Why SECDED ECC Fails: From Triple-Bit Miscorrection to the DUE Window

The SECDED (Single Error Correction, Double Error Detection) code corrects 1-bit errors, detects 2-bit errors, but miscorrects 3-bit errors into silent data corruption. On an RTX A6000 with ECC enabled, researchers measured 11 DUEs (detectable uncorrectable errors) and 1 SDC (silent data corruption) in one day of hammering on a single bank.

The average frequency of one DUE roughly every two hours exposes the system to denial-of-service conditions. More critical is the behavior of DUEs on NVIDIA GPUs: serviced lazily, they leave a roughly 10 ms window between detection and GPU kill. During this interval the corrupted data is consumed by the attacker's GPU kernel.

As the researchers state in the paper: "Moreover, we discover that even double-bit DUEs are exploitable, since DUEs are serviced lazily in NVIDIA GPUs, leaving a ~10 ms time window between DUE detection and the GPU being killed, during which the corrupted data is consumed by the attacker's GPU kernel".

The End-to-End Escalation: From GPUHammer to GPUThor

The escalation exploit reuses code from GPUBreach, the same team's prior research: corrupting the GPU page table, repointing entries to CPU memory, overwriting process credential structures. Locating exploitable multi-bit errors without triggering DUEs took roughly four days on the A6000.

The end-to-end escalation time has collapsed: from 21.9 hours with GPUHammer to 1.1 minutes with GPUThor. The shift from hours to minutes makes the attack operationally practical in real-world scenarios.

"We used these to crash GPUs and to escalate privileges with ECC enabled. ECC still raises the bar and remains worth enabling, but it can no longer be treated as a sufficient defense" — University of Toronto researchers, GPUThor project

The quote measures the distance traveled in twelve months. In July 2025 NVIDIA published a security notice stating: "enabling System-Level ECC mitigates the Rowhammer problem." GPUThor demonstrates that assertion does not hold for Ampere workstation GPUs with the specific GDDR6 implementation tested.

What to Do Now

NVIDIA issued an advisory on August 21, 2026 with four specific action items for operators. Researchers add complementary recommendations based on experimental results.

Enable SYS-ECC and IOMMU/DMA isolation. The August 21 NVIDIA advisory requires both active. Researchers confirm that enabling IOMMU blocks the double-bit DUE route, reducing exposure to the triple-bit SDC alone, which requires rarer conditions.

Monitor GPU error telemetry. The NVIDIA recommendation specifies systematic error tracking. Researchers advise paying close attention to ECC counters as an early indicator of suspicious activity.

Restrict untrusted CUDA workloads. Both sources converge: unverified workloads on shared GPUs represent the primary attack vector. Cross-tenant risk is concrete when multiple users access the same GPU.

Avoid cross-tenant GPU sharing. Researchers explicitly recommend this separation, which goes beyond vendor guidance and is based on the practical demonstration of escalation with unprivileged CUDA access.

The Hardware Gap NVIDIA Cannot Close in Software

The matrix of tested GPUs reveals precise fragmentation. No bit flips on A10, L4, L40 (GDDR6), RTX 4090 (GDDR6X), or A30 (HBM2e). Server-class Ampere and Blackwell GPUs feature Error Containment, Dynamic Page Offlining, and RAS Repair, which make the DUE-based route more time-consuming but do not prevent it entirely. The SDC-based route could still work on these architectures.

A100 and H100 were not tested; their vulnerability status remains unknown. An effective fix would require multi-bit ECC and in-DRAM defenses such as Refresh Management and Per-Row Activation Counting in future GPUs, not software updates on existing cards.

The Countdown to November

Disclosure to NVIDIA occurred on April 29, 2026, with an embargo until August 25, 2026. No patch is available as of August 27, 2026. Exploit code goes public November 15, 2026, the opening day of ACM CCS, increasing pressure on existing deployments.

For AI and cloud infrastructures running RTX A4000-A6000, the gap between vendor recommendation and technical reality is measured in minutes of exploit, not hours of theory. NVIDIA's position has shifted from "ECC mitigates" to "ECC, IOMMU, monitoring, and workload restriction" — a layered defense that implicitly acknowledges no single countermeasure is sufficient.

Sources

• https://thehackernews.com/2026/08/gputhor-rowhammer-defeats-ecc-on-nvidia.html
• https://www.bleepingcomputer.com/news/security/new-gputhor-attack-defeats-nvidia-ecc-protection-for-root-access/
• https://thehackernews.com/2025/07/gpuhammer-new-rowhammer-attack-variant.html
• https://thehackernews.com/2021/11/new-blacksmith-exploit-bypasses-current.html
• https://thehackernews.com/2026/04/new-gpubreach-attack-enables-full-cpu.html
• https://thehackernews.uk/zero-trust-claude-d

Information verified against cited sources and current as of publication.

Sources