Nvidia’s ECC was supposed to stop memory corruption, but attackers can hammer their way to root

Hackers can reliably induce bit flips in the GPU’s memory and crash the device, corrupt data, or, at worst, gain root access. Researchers hammered Nvidia Ampere GPUs so hard that even ECC (Error Correction Code) was overwhelmed.

Researchers at the University of Toronto disclosed a new attack against Nvidia GPUs, called GPUThor. It relies on rapid memory access to reliably introduce bit flips that corrupt the memory.

GPUThor is a variation of the bit-flipping memory attack against DRAM (Dynamic Random-Access Memory), known as Rowhammer, which was first introduced back in 2014.

Researchers experimented on an Ampere architecture NVIDIA GPUs (A4000, A4500, A5000, A6000) and developed techniques yielding 500-23,500 times more bit flips than previous attempts.

“This corrupts multiple bits at once and overwhelms the ECC, enabling the first GPU denial-of-service attacks and root-level privilege escalation on ECC-protected GPUs,” the researchers claim on their website.

The paper claims that GPUThor can complete an end-to-end privilege escalation exploit on the A6000 card in 1.1 minutes, orders of magnitude faster than the previous best technique, which required 21.9 hours of nonstop GPU hammering.

When GPUThor pounds one gigabyte of GPU memory, it produces up to 377,552 bit flips over 24 hours.

The density is high enough to introduce 387 double-bit errors, which ECC can detect but cannot correct, and 2 triple-bit errors, which ECC silently corrupts into the wrong value rather than repairing them.

A single uncorrectable error crashes the GPU and kills all running jobs.

“On an A6000 with ECC enabled, GPUThor triggers one GPU reset every 2 hours, inducing Denial-of-Service. In a day, the GPU declares itself defective and due for replacement, once it can no longer remap rows with uncorrectable errors,” the researchers warn.

Root-shell can be achieved “for the first time with ECC enabled” using both double- and triple-bit errors.

A higher bit flip rate was achieved by using non-uniform memory access patterns.

The attack technique is general, so other GPUs using similar memory and defenses may also be at risk,

said researchers on the dedicated website gputhor.com.

The exploit is not yet public. The researchers responsibly disclosed the findings to Nvidia back on April 29th, 2026, and agreed to hold under embargo for 4 months.

The full code and artifacts will be released publicly on November 15th, 2026.

Ampere microarchitecture was officially announced on May 14th, 2020. The GPUs are still supported, but have been superseded by later Ada Lovelace and Hopper architectures.

Newer GPUs seem to be immune to this exploit. GPUThor didn’t produce flips on newer memory types, including HBM, GDDR6X, and GDDR7. Researchers speculate that those chips use different internal defenses. HBM3 and GDDR7 also add on-die ECC, reducing error visibility.

“We cannot rule out that alternative patterns can induce bit flips on those products, and follow-up work can investigate this.”

Can you get hacked?

To leverage this exploit, unprivileged attackers need to launch low-level code – CUDA kernels on NVIDIA GPU with GDDR6 memory, such as A4000–A6000. These workloads are often accessible in the cloud, where GPUs are shared between multiple tenants.

Attackers potentially can flip bits, crash the shared GPU, or read or modify other users’ data.

“Even if the GPU is not time-shared, any untrusted code that runs on the GPUs can escalate to root-level privileges, and serve as an entry-point for malware into the system,” the research warns.

Simply visiting a malicious website from a machine with a vulnerable GPU won’t launch a devastating attack. But a malicious code running on the system can potentially leverage GPUThor, especially if ECC is not enabled.

The researchers recommend that cloud operators avoid sharing a single physical GPU across untrusted tenants and monitor error-correction counters.

“All GPU users should exercise care while running untrusted code on their GPU. A complete fix requires stronger hardware-level defenses in future GPUs.”