New GPUThor Rowhammer Attack Bypasses ECC on NVIDIA RTX A6000 GPUs

How GPUThor Circumvents Hardware Safeguards

Academic researchers have disclosed a novel Rowhammer vulnerability affecting NVIDIA RTX A6000 workstation GPUs equipped with GDDR6 memory, demonstrating that the attack can bypass error correction codes (ECC) — a mitigation NVIDIA previously recommended — to achieve denial-of-service conditions and privilege escalation to root access on the host system. The findings were presented in a security paper released on August 27, 2026, highlighting a significant gap in GPU-side memory protections.

The GPUThor attack exploits physical memory bit flips in GDDR6 chips through precisely timed electrical disturbances, overcoming ECC mechanisms designed to detect and correct such errors. Unlike traditional Rowhammer attacks targeting system RAM, this variant focuses on GPU memory, allowing attackers with user-level access to execute arbitrary code or crash GPU-dependent workloads. Researchers showed that by manipulating memory access patterns in graphics or compute workloads, they could induce persistent bit flips that ECC failed to correct, ultimately enabling host-level privilege escalation.

Can This Be Fixed Without Performance Loss?

The attack leverages the high bandwidth and parallel architecture of GDDR6 memory, which, while efficient for graphics processing, creates exploitable timing windows for bit flips. Researchers noted that ECC on these GPUs operates with latency and coverage limitations under sustained hammering patterns, allowing multiple bit errors to accumulate in adjacent memory cells. By reverse-engineering the memory controller’s refresh behavior, the team crafted access sequences that evaded detection thresholds. „We found that ECC, as implemented, cannot keep up with the error rate induced by our targeted access patterns,” one researcher explained, emphasizing that the flaw lies not in the absence of ECC but in its real-world effectiveness under stress.

Mitigating GPUThor presents a challenge, as traditional software-based Rowhammer defenses like increased refresh rates or memory partitioning could severely impact GPU performance in compute-intensive applications. NVIDIA has not yet released a patch, and researchers warn that hardware revisions may be necessary to address the root cause in GDDR6 subsystems. In the meantime, they recommend restricting untrusted GPU workloads and monitoring for anomalous memory errors as interim measures. The disclosure raises broader concerns about the security of GPUs in shared environments such as cloud computing and AI workloads, where isolation between users is critical.

How does GPUThor differ from CPU-based Rowhammer attacks? GPUThor targets GDDR6 memory on NVIDIA workstation GPUs rather than system DRAM, exploiting the parallel access patterns and ECC limitations unique to graphics memory subsystems to achieve host root access.

Frequently Asked Questions

Is ECC completely ineffective against this attack? No, ECC still functions but can be overwhelmed by the rate and distribution of induced bit flips, allowing uncorrectable errors to accumulate and bypass detection during sustained hammering sequences.

What systems are most at risk? Workstations and servers using NVIDIA RTX A6000 or similar GPUs with GDDR6 memory that execute untrusted GPU workloads, particularly in shared or virtualized environments, are vulnerable to exploitation.