GPUBreach, a newly discovered attack, leverages Rowhammer bit alterations in GPU GDDR6 to elevate permissions, potentially compromising the entire system.

Developed by researchers at the University of Toronto, GPUBreach will be fully explained at the IEEE Symposium on Security & Privacy in Oakland on April 13.

The researchers revealed that Rowhammer-induced bit changes in GDDR6 can corrupt GPU page tables, giving an unauthorized CUDA kernel the ability to read and write to any GPU memory location.

An attacker could then exploit memory vulnerabilities in the NVIDIA driver to gain unauthorized access to the CPU side, leading to a complete system takeover, even with Input-Output Memory Management Unit (IOMMU) protection enabled.

IOMMU is a hardware component that safeguards against direct memory intrusions by controlling and restricting device access to memory, specifying which memory areas each device can access.

Despite its effectiveness against many direct memory access (DMA) attacks, IOMMU doesn’t prevent GPUBreach.

“GPUBreach demonstrates that GPU Rowhammer attacks can escalate privileges beyond mere data corruption,” the researchers stated.

“An unauthorized CUDA kernel can gain arbitrary GPU memory read/write capabilities by corrupting GPU page tables. This can then be used to exploit newly discovered memory-safety issues in the NVIDIA driver, resulting in CPU-side privilege escalation.”

“This results in full system control, up to root, without disabling IOMMU – unlike other methods. This makes GPUBreach potentially more hazardous.”

The same researchers previously presented GPUHammer, which proved that Rowhammer attacks on GPUs are feasible. This led NVIDIA to issue a warning and suggest activating System Level Error-Correcting Code to prevent such attacks on GDDR6 memory.

However, GPUBreach escalates the threat, showing that root privileges can be obtained with IOMMU activated, not just data corruption achieved.

The researchers demonstrated these results using an NVIDIA RTX A6000 GPU with GDDR6, a model widely used in AI development and training applications.

The University of Toronto researchers alerted NVIDIA, Google, AWS, and Microsoft to their findings on November 11, 2025.

Google acknowledged the report and awarded the researchers a reward of $600.

NVIDIA indicated that it might revise its existing security advisory from July 2025 to address the newly uncovered attack possibilities.

The researchers proved that relying solely on IOMMU is inadequate if GPU-managed memory can undermine trusted driver states; thus, at-risk users should avoid relying on it alone.

Error Correcting Code (ECC) memory can correct single-bit errors and identify double-bit errors but is unreliable against multi-bit errors.

Ultimately, the researchers emphasized that GPUBreach is completely unaddressed for consumer GPUs lacking ECC.

The researchers will release full details of their study, including a technical document and a GitHub repository containing the replication instructions and scripts, on April 13.

NVIDIA informed BleepingComputer that for enterprise environments, they suggest enabling System Level Error-Correcting Codes to protect against Rowhammer-style attacks. This feature is enabled by default on Hopper and Blackwell Data Center class of GPUs.