GPUThor: A Rowhammer attack bypasses ECC on NVIDIA RTX A6000 to gain root access to the host

Researchers unveil GPUThor, a Rowhammer attack targeting NVIDIA GPUs that bypasses ECC memory on an RTX A6000 and achieves root privileges on the host machine—a new hardware-layer privilege escalation vector.

What: Rowhammer on GPU, ECC Bypassed

GPUThor is a Rowhammer-style attack targeting NVIDIA GPUs. Documented by academic researchers and covered by The Hacker News, it targets the GDDR6 memory of an NVIDIA RTX A6000 and succeeds in bypassing ECC (Error-Correcting Code, error-correcting memory) — a hardware protection designed to render Rowhammer ineffective.

The ultimate goal: obtain a root shell on the machine from an unprivileged context (privilege escalation to a root shell). The result is demonstrated on an NVIDIA RTX A6000.

Reminder: What is Rowhammer?

Rowhammer (French for "Marteau de rangée") is an attack technique that exploits a physical flaw in DRAM memory chips: by rapidly and repeatedly accessing a row of memory cells, it is possible to induce bit flips in adjacent rows — without directly accessing them. These bit flips can corrupt critical data: cryptographic keys, page table entries, permission bits.

ECC (error-correcting memory) is the classic hardware response to Rowhammer: the chip detects and corrects bit errors on the fly. Professional GPUs (RTX A6000, A100, H100) include ECC precisely for this reason — for ML/HPC workloads where computational integrity is critical.

GPUThor demonstrates that this protection is not absolute on the RTX A6000.

Who is impacted

The most exposed environments are those where multiple users or VMs share a physical GPU:

• Shared GPU compute clusters (HPC, cloud ML): an unprivileged user could exploit a similar flaw to escalate privileges.
• Development machines with GPU access from containers or sandboxed environments.
• Workstations with professional GPUs (RTX A6000, RTX 6000 Ada) in multi-user environments.

Consumer GPUs without ECC (RTX 4090, RTX 5090) are not protected by ECC — but GPUThor specifically demonstrates ECC bypass on professional hardware. Consumer GPUs have other Rowhammer vulnerability profiles.

Analysis: An emerging attack vector

GPUThor is part of a broader trend: hardware-level attacks on GPUs are increasing in sophistication as GPUs become critical components of infrastructure. By 2026, an A6000 GPU in an ML cluster will process confidential training data, proprietary model weights, and potentially authentication tokens.

Privilege escalation to a root shell from a GPU context — if the technique is reproducible and generalizable — is a scenario that hyperscaler security teams take very seriously.

What to do now

Immediate actions:

1. Monitor NVIDIA bulletins: NVIDIA maintains a security portal (nvidia.com/en-us/security/) — watch for a GPUThor-specific advisory.
2. Restrict unsupervised GPU access in multi-tenant environments: avoid sharing a physical GPU across workloads of differing trust levels.
3. Update NVIDIA drivers as soon as patches are available — mitigations may come via driver, firmware, or GPU BIOS.
4. Document exposure: inventory RTX A6000 and NVIDIA professional cards with ECC in the environment and prioritize their monitoring.