NVIDIA’s recommended defense against GPU memory attacks has a hole in it, and a team at the University of Toronto has demonstrated why. Their GPUThor technique smashes through error correction codes on workstation cards with GDDR6 memory, opening the door to denial-of-service and privilege escalation that ends in a root shell.
Four Ampere-class cards fell to the attack after the researchers hammered four DRAM banks for 24 hours each, flipping bits on every model tested: the RTX A6000 with 48 GB, the RTX A5000 with 24 GB, the RTX A4500 with 20 GB, and the RTX A4000 with 16 GB. The prerequisite is the ability to launch an unprivileged CUDA kernel on the target GPU, either as a co-tenant on a shared card or as untrusted code on a single-tenant machine.
The imbalance is what makes it work. Decoy rows meant to exhaust the memory’s Target Row Refresh defense get far fewer activations than the aggressor row beside the victim, a pattern earlier GPU work never produced because it treated both row types equally. Repeated accesses inside a single warp, the group of 32 threads a GPU runs in lockstep, get merged at the memory controller, and that is the mechanism the researchers exploit.
NVIDIA’s July 2025 security notice, issued after the same team’s GPUHammer work, says enabling System-Level ECC mitigates the problem. The researchers go further, recommending against cross-tenant GPU sharing, monitoring ECC error counters, and keeping untrusted CUDA workloads off production cards.
