Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs

DRAM stores each bit as charge in a cell, and cells are packed into rows that sit very close together. Rowhammer is a read-disturbance failure: repeatedly activating (“hammering”) one row leaks charge from the cells in adjacent rows and flips their bits. No permission to those neighboring rows is needed, which is what makes Rowhammer useful for data tampering, sandbox escapes, and privilege escalation. DRAM chips ship with an in-DRAM mitigation, Target Row Refresh (TRR): the chip samples frequently activated rows and issues a corrective refresh to their neighbors. Attacks evade TRR by mixing in decoy rows to overwhelm the sampler.

Our previous work, GPUHammer (2025), first demonstrated Rowhammer bit flips in the GDDR6 memory of NVIDIA GPUs, and follow-up work, GPUBreach (2026) showed the privilege escalation all the way to root shell on the CPU. At that time, NVIDIA recommended enabling ECC as a mitigation (NVIDIA Security Notice, 2025). All prior GPU attacks are defeated once ECC is enabled since they yield only tens to hundreds of flips per GB that can be corrected by the ECC on the NVIDIA GPUs; these bit flip rates are orders of magnitude below CPU attacks such as Blacksmith (≈550,000 flips/GB on DDR4).

Prior GPU attacks hammer uniformly: the aggressor row next to the victim is activated about as often as the decoys, so most of the effort lands on rows that do not matter. CPU attacks moved to non-uniform patterns years ago; no GPU attack had managed it. GPUThor enables non-uniform hammering on GPUs by overcoming two undocumented behaviors as follows.

Together these yield the attack pattern below: a 6-tREFI pattern sustaining ≈110,000 aggressor activations per refresh window, 6.6× the intensity of prior uniform GPU attack patterns.

Higher flip density also shortens the search for an exploitable flip. An end-to-end privilege-escalation exploit that takes 21.9 hours with GPUHammer patterns on an A6000 completes in 1.1 minutes with GPUThor.

We evaluated four Ampere-class NVIDIA workstation GPUs with GDDR6 memory — cards widely used in AI workstations and in the cloud. All four are vulnerable to bit flips with our attack and an unprivileged CUDA kernel can exploit these to mount the attacks above.

GPUThor appears at the ACM SIGSAC Conference on Computer and Communications Security (CCS ‘26), 15–19 November 2026, in The Hague, The Netherlands.

📄 Read the full paper (PDF) 💻 Code & Artifact

Our code and artifacts will be released publicly at github.com/sith-lab/gputhor on 15 November 2026.

@inproceedings{lin2026gputhor, author = {Chris S. Lin and Joyce Qu and Aditya Rajeev and Gururaj Saileshwar}, title = {{GPUThor}: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit {ECC}-Protected {GPUs}}, booktitle = {Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS '26)}, year = {2026}, location = {The Hague, The Netherlands}, publisher = {ACM}, }

Acknowledgements

This research was supported by Natural Sciences and Engineering Research Council of Canada (NSERC) under funding reference number RGPIN-2023-04796, and an NSERC-CSE Research Communities Grant under funding reference number ALLRP-588144-23. Researchers funded through the NSERC-CSE Research Communities Grants do not represent NSERC, the Communications Security Establishment Canada (CSE) or the Government of Canada. Any research, opinions or positions they produce as part of this initiative do not represent the official views of NSERC, CSE or the Government of Canada.