New research has uncovered several RowHammer attacks targeting powerful graphics cards (GPUs). These attacks can be used to gain higher levels of access and, in some cases, completely control a computer.

These attacks are called GPUBreach, GDDRHammer, and GeForge.

GPUBreach goes beyond GPUHammer, showing for the first time that RowHammer bit-flips in GPU memory can do more than just corrupt data. It can lead to increased privileges and total system takeover.

“By using GDDR6 bit-flips to corrupt GPU page tables, a regular process can get unauthorized read/write access to GPU memory. This can then be used to exploit memory errors in the NVIDIA driver and gain full CPU control, creating a root shell,” said Gururaj Saileshwar, a study author and professor at the University of Toronto, in a LinkedIn post.

A key feature of GPUBreach is that it works even when the input–output memory management unit (IOMMU) is enabled. The IOMMU is an important security feature that protects memory by preventing Direct Memory Access (DMA) attacks and isolating each component’s memory.

“GPUBreach demonstrates that the IOMMU isn’t enough. By corrupting trusted driver information within buffers that the IOMMU allows, we can trigger kernel-level writes beyond the allocated memory, bypassing the IOMMU protections even when it’s enabled,” Saileshwar added. “This has major implications for cloud AI, shared GPU environments, and high-performance computing.”

RowHammer is a long-known problem with Dynamic Random-Access Memory (DRAM). Repeatedly accessing a memory row can cause electrical interference, flipping bits (changing 0s to 1s or vice versa) in nearby rows. This compromises the security that modern operating systems and sandboxes rely on.

DRAM manufacturers have added hardware protections such as Error-Correcting Code (ECC) and Target Row Refresh (TRR) to defend against this type of attack. 

However, research from the University of Toronto in July 2025 showed that GPUs are also vulnerable. GPUHammer is the first practical RowHammer attack targeting NVIDIA GPUs that use GDDR6 memory. It uses techniques like multi-threaded hammering to overcome obstacles that previously made GPUs resistant to bit flips.

A successful GPUHammer attack can significantly reduce the accuracy of machine learning (ML) models, by as much as 80% when running on a GPU.

GPUBreach expands on this by using RowHammer to corrupt GPU page tables and escalate privileges, allowing unauthorized read/write access to GPU memory. More importantly, the attack can leak secret cryptographic keys from NVIDIA cuPQC, manipulate model accuracy, and achieve CPU privilege escalation even with IOMMU enabled.

“The compromised GPU performs DMA (using aperture bits in PTEs) into a CPU memory region permitted by the IOMMU (the GPU driver’s own buffers),” the researchers explained. “By corrupting this trusted driver data, the attack causes memory errors in the NVIDIA kernel driver and gains arbitrary kernel write access, which is then used to create a root shell.”

The release of GPUBreach coincides with two other similar projects – GDDRHammer and GeForge – which also involve corrupting GPU page tables via GDDR6 RowHammer to escalate GPU privileges. Like GPUBreach, both techniques can grant unauthorized read/write access to CPU memory.

GPUBreach is unique because it also enables full CPU privilege escalation, making it a more dangerous attack. GeForge, specifically, requires the IOMMU to be disabled to function, while GDDRHammer modifies the aperture field of the GPU page table entry to allow the CUDA kernel to read and write all of the host CPU’s memory.

“A key difference is that GDDRHammer exploits the last level page table (PT), and GeForge exploits the last level page directory (PD0),” the teams behind the two GPU memory exploits stated. “However, both works achieve the same goal: hijacking the GPU page table translation to gain read/write access to both GPU and host memory.”

A temporary way to address these attacks is to enable ECC on the GPU. However, it’s important to note that RowHammer attacks like ECCploit and ECC.fail have been shown to bypass this defense.

“However, if attack patterns cause more than two-bit flips (which is possible on DDR4 and DDR5 systems), existing ECC can’t correct them and may even cause silent data corruption. Therefore, ECC isn’t a perfect protection against GPUBreach,” the researchers concluded. “On desktop or laptop GPUs, where ECC isn’t currently available, there are no known defenses to our knowledge.”