GPUThor Overcomes ECC on Four NVIDIA Ampere Workstation GPUs
University of Toronto researchers disclosed GPUThor, a Rowhammer technique that can overcome ECC protections on four NVIDIA Ampere workstation GPUs with GDDR6 memory. The paper reports denial-of-service and host-root escalation demonstrations on an ECC-enabled RTX A6000; NVIDIA's updated guidance calls for SYS-ECC alongside host IOMMU or DMA isolation, telemetry monitoring, and tenancy controls.
University of Toronto researchers have disclosed GPUThor, a Rowhammer technique that they report can overcome error-correcting-code protections on four NVIDIA Ampere workstation GPUs with GDDR6 memory. NVIDIA's August 2026 advisory confirms that the research demonstrated bit flips on the RTX A4000, A4500, A5000, and A6000, and updates its guidance to a defense-in-depth approach.
The researchers report denial-of-service and host-root privilege-escalation demonstrations on an RTX A6000 with ECC enabled. The paper is scheduled for presentation at ACM CCS 2026 in November.
What the research demonstrated
Rowhammer is a DRAM read-disturbance problem: repeated activation of one memory row can change bits in nearby rows. GPUThor uses a non-uniform access pattern designed to evade GDDR6 Target Row Refresh while accounting for GPU memory-request coalescing.
The authors report 72,000 to 377,000 bit flips per GB across the four tested cards with ECC disabled. On ECC-enabled hardware, they report 387 double-bit errors that the ECC detected but could not correct, plus two triple-bit errors that it repaired incorrectly. The project materials also describe an A6000 reset about every two hours during a sustained denial-of-service demonstration.
The reported privilege-escalation path corrupts GPU page tables. The researchers say an unprivileged CUDA program can then obtain access leading to a root shell on the host CPU. The evaluation confirms bit flips on the four listed Ampere workstation GPUs; it does not establish identical behavior for every NVIDIA architecture or memory technology.
Updated mitigation guidance
NVIDIA says its August guidance supersedes reliance on a single control. It continues to recommend SYS-ECC, but says it should be combined with host IOMMU or DMA isolation, monitoring of correctable and uncorrectable memory errors, and an assessment of GPU sharing and workload-isolation practices.
For shared GPU systems, the relevant boundary is whether an untrusted workload can launch device code and whether GPU-side memory corruption can reach privileged host memory. NVIDIA says cross-tenant risk depends on concurrent sharing, scheduling, platform isolation, and error-containment behavior; its advisory also notes that a single-tenant system can face a local privilege-escalation risk if DMA isolation is disabled or insufficient.
The result is a hardware-security finding, not evidence that all NVIDIA GPUs are vulnerable. It does show that, for the evaluated GDDR6 workstation cards, ECC remains a useful layer but is not by itself a complete Rowhammer defense.
Key Points
- 1GPUThor's authors report ECC-bypassing Rowhammer effects on four Ampere workstation GPUs with GDDR6 memory, including denial of service and a host-root escalation demonstration.
- 2The technique uses non-uniform hammering and reverse-engineered memory-request behavior; the paper reports 72,000 to 377,000 bit flips per GB with ECC disabled.
- 3NVIDIA's updated advisory recommends layered controls: SYS-ECC, host IOMMU or DMA isolation, reliability telemetry, and review of tenancy and workload-isolation boundaries.
Scoring Rationale
The research concerns hardware isolation in shared and untrusted-code GPU environments: its authors report denial-of-service and host-root escalation on evaluated ECC-enabled workstation GPUs, while NVIDIA has issued updated defense-in-depth guidance.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
