GPUThor beats NVIDIA ECC: who shares your GPU?

University of Toronto researchers disclosed GPUThor, a Rowhammer attack that defeats error-correcting code on NVIDIA workstation GPUs and escalates an unprivileged CUDA workload to a root shell on the host. The technical headline is the bit-flip rate. The operational headline, if you rent GPU time by the hour, is a question you probably have not asked your vendor: who else is running code on that card?

What actually happened

Per The Hacker News' write-up of the research and BleepingComputer's coverage, GPUThor uses non-uniform hammering — pounding the aggressor row far harder than the decoy rows — to slip past GDDR6's Target Row Refresh defense.

The numbers:

• 72,000 to 377,552 bit flips per gigabyte of GPU memory across four tested cards: RTX A4000, A4500, A5000, and A6000. All Ampere-generation, all GDDR6.
• Time to find an exploitable flip in the GPU page tables drops from roughly 21.9 hours with the earlier GPUHammer patterns to about 1.1 minutes.
• ECC does not close it. On an A6000 with ECC on, one bank produced 11 uncorrectable errors and one silent data corruption event in 24 hours. SECDED ECC corrects one bit and detects two — it mis-corrects three, which is how the silent corruption happens.
• Not everything flipped. A10, L4, L40, RTX 4090 (GDDR6X), and A30 (HBM2e) showed no vulnerability in testing. A100 and H100 were not tested.

There is no CVE. NVIDIA updated its Rowhammer security notice in August 2026, and its guidance is: enable System-Level ECC, enable IOMMU/DMA isolation, monitor GPU error telemetry, and restrict sharing or execution of untrusted workloads. The paper goes public November 15, 2026, at ACM CCS. No in-the-wild exploitation has been reported.

Why GPU multi-tenancy matters for your business

The precondition is the whole story: GPUThor needs an unprivileged CUDA kernel running on the target card. That is a co-tenant on shared hardware, or untrusted code on a machine you own. Nothing else.

So the question is not whether to panic about Rowhammer — you are not going to fix DRAM. The question is what your inference bill actually buys. Cheap per-token pricing on a GPU cloud usually means the card is shared, sliced with MIG or time-sliced across tenants. That is normally a cost story. GPUThor makes it a boundary story, and the researchers' recommendation is blunt: avoid cross-tenant GPU sharing.

Ask your provider three things in writing. Dedicated card or shared? Is System-Level ECC on? Do you monitor and act on ECC error counters? A vendor that cannot answer those in a day is telling you something.

The second thing worth internalizing: ECC is not a security control. It was built to catch cosmic-ray bit flips, not an adversary shaping the error pattern. Keep it on. Stop treating it as the answer.

If you run local GPUs — a workstation A6000 doing batch embeddings — the risk is untrusted CUDA code, which now includes kernels and dependencies you did not write. The dependency-depth problem we flagged in the Next.js AVIF chain applies to anything you pip install that ships a compiled kernel.

Sources: The Hacker News, BleepingComputer.