University of Toronto Researchers Break NVIDIA's ECC Defense, Cut GPU Root-Access Attack Time to 1.1 Minutes

Researchers at the University of Toronto have found a way to break through the one defense NVIDIA told customers would stop GPU Rowhammer attacks cold. It didn't.

The attack, called GPUThor, was disclosed August 25, 2026, and hits four Ampere-class NVIDIA workstation GPUs with GDDR6 memory: the RTX A4000, A4500, A5000, and A6000. All four are widely used in AI research clusters and commercial cloud GPU fleets, according to Bleeping Computer. The research team, Chris S. Lin, Joyce Qu, Aditya Rajeev, and Gururaj Saileshwar, will present the work at the ACM Conference on Computer and Communications Security (CCS '26) in The Hague in November, according to Cyber Insider.

The team privately disclosed the flaw to NVIDIA on April 29, 2026, and also notified Google, Microsoft, and AWS. They held the research under embargo until NVIDIA published updated guidance in August, per Cyber Insider. The exploit code itself is scheduled for public release on November 15, 2026, when the CCS '26 conference opens, according to Tech Times. That's a real deadline for cloud operators to shore up defenses before working attack code is sitting in the open.

What Actually Broke

Rowhammer is old news in security circles. It exploits a physical quirk of DRAM: hammer one memory row with repeated access, and you can flip bits in a neighboring row you're not even supposed to touch. NVIDIA's answer to this on its workstation cards has been SECDED ECC, error-correcting code that fixes single-bit errors and flags double-bit errors so a system administrator knows something's wrong.

NVIDIA said as much in a July 2025 security notice, stated by Hacker News: "researchers at the University of Toronto demonstrated a successful Rowhammer exploitation on an NVIDIA A6000 GPU with GDDR6 memory where System-Level ECC was not enabled. In the same paper, the researchers showed that enabling System-Level ECC mitigates the Rowhammer problem."

GPUThor breaks that assumption. The trick, according to Hacker News and Cyber Insider, is non-uniform hammering. Earlier attacks hit the attacker-controlled "aggressor" row and the decoy rows used to fool the memory's Target Row Refresh (TRR) defense at roughly the same rate. GPUThor instead reverse-engineered two undocumented GPU behaviors: how the memory controller merges repeated access requests within a single warp (a group of 32 threads running in lockstep), and how often TRR actually kicks in on these Ampere GDDR6 chips, which the researchers found is roughly once every 72 refresh intervals rather than every interval.

Built around a six-interval pattern exploiting that gap, GPUThor generates about 110,000 aggressor-row activations per refresh window, 6.6 times the intensity of prior attacks, per Cyber Insider.

The Numbers

With ECC disabled, the campaigns produced between 72,000 and 377,000 bit flips per gigabyte across the four cards, according to all five sources. The RTX A5000 was worst-hit at 377,552 flips per gigabyte, which Hacker News calculates as 23,597 times the 16 flips per gigabyte the same research team's earlier GPUHammer attack achieved in 2025, and roughly 500 times the rate of GDDRHammer, the previous strongest GPU Rowhammer attack.

That density shift matters practically. Finding an exploitable bit flip in GPU page tables, the prerequisite for taking over the host, drops from about 21.9 hours under GPUHammer to roughly 1.1 minutes under GPUThor, according to Tech Times and Bleeping Computer.

With ECC turned on, the story doesn't get better. Across the four cards, the attack produced 387 double-bit errors that ECC could detect but not fix, and two triple-bit errors that ECC actively repaired incorrectly, according to Bleeping Computer and Tech Times, silently corrupting data with no alert raised.

Two Ways This Goes Bad

On an ECC-enabled RTX A6000, GPUThor can force the GPU to reset roughly every two hours, killing whatever workload is running, per Bleeping Computer. Do that enough times and the card exhausts its spare-row remapping capacity and flags itself for replacement, a hardware-level denial-of-service that costs someone a GPU.

The more serious outcome is privilege escalation. By corrupting GPU page tables through those undetected triple-bit errors, an unprivileged CUDA program, code that shouldn't have special access, can gain arbitrary memory access and open a root shell on the host machine, according to Bleeping Computer and Cyber Insider. That means a malicious tenant on a shared cloud GPU, or untrusted code on a single-tenant box, could potentially break out and take over the whole system.

What's Being Recommended

The researchers' advice, per Hacker News, is blunt: avoid cross-tenant GPU sharing, monitor ECC error counters for anomalies, and restrict untrusted CUDA workloads from running on exposed hardware. None of that is a permanent fix. It's damage control until NVIDIA ships something better than ECC, or until customers retire the affected Ampere cards.

Coverage of this story has been consistent across outlets. Tech Times, Hacker News, Bleeping Computer, and Cyber Insider all describe the same disclosure timeline, the same four GPUs, and the same bit-flip figures, which points to a single underlying academic paper rather than independent verification. Consistent coverage reflects agreement on the source material, not five separate confirmations.

What's unresolved is what NVIDIA does next. The company's August guidance update, referenced by Cyber Insider, has not been detailed in public reporting beyond its existence. Whether that guidance includes a firmware patch, a hardware revision for future cards, or just more warnings to isolate untrusted workloads is the open question cloud providers running these Ampere GPUs need answered before November 15.