Rowhammer attacks on professional GPUs were long considered a solved problem once ECC was in the picture. A University of Toronto team just broke that assumption. Their paper, GPUThor, demonstrates a high-intensity rowhammer attack specifically targeting ECC-protected NVIDIA GPUs. For anyone running an NVIDIA card for AI inference, rendering, or datacenter work, the security model you were handed at purchase no longer holds. The card you bought for its error-correction guarantee is now a potential attack surface.

The mechanism works in two stages. First, GPUThor reverse engineers how the GPU coalesces memory accesses, then uses that knowledge to construct non-uniform hammering patterns. The pattern hits aggressor rows harder than decoy rows, concentrating electrical disturbance where bit-flips are most likely. Second, the attack identifies the exact refresh instances when in-DRAM mitigations fire. By timing the hammering to span across those refresh intervals, it constructs longer patterns the mitigation never registers as a single contiguous threat. The net effect is sustained, high-intensity disturbance that ECC alone cannot correct, even on cards designed to tolerate single-bit errors.

Before GPUThor, the practical assumption for ECC-equipped NVIDIA GPUs was straightforward: rowhammer bit-flips might occur under sustained stress, but ECC would catch and correct them. The card was safe by design. The paper shows that hammering intensity can be pushed high enough, and sustained long enough across refresh boundaries, that the cumulative error rate exceeds what ECC can handle. For a workstation user buying a professional card for its error-correction capability, or a datacenter operator relying on ECC against silent data corruption, that guarantee is now compromised. The trust boundary shifts from the memory controller down to the DRAM cell.

The source is thin. It is an abstract excerpt and a link to the arXiv preprint. No specific GPU model is named beyond "NVIDIA GPUs." No bit-flip rate, no number of hammering cycles, no comparison against prior rowhammer attacks on GPUs. The paper does not state whether consumer (non-ECC) cards are equally vulnerable, nor does it describe a working exploit or a proof-of-concept binary. Whether the technique applies to HBM in addition to GDDR6 is not addressed in the excerpt.

Watch for NVIDIA's response. If the technique generalizes beyond ECC cards, expect a firmware or driver-level mitigation announcement within the quarter. Also watch whether the full paper names specific GDDR6 vendors or process nodes, which would narrow the affected population considerably. For end users, the immediate action is nil unless you are running untrusted code on a GPU you do not control. The practical risk today is limited to adversarial or compromised workloads.