New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips
Academic researchers have disclosed several RowHammer-style exploits aimed at modern high-performance GPUs that can be leveraged to elevate privileges and, under certain conditions, seize complete control of the host machine. The work has been labeled GPUBreach, with related efforts named GDDRHammer and GeForge.
Unlike prior GPU-focused RowHammer research, GPUBreach demonstrates that bit-flips in GDDR6 can do far more than corrupt data: they can be used to manipulate GPU page tables, yielding arbitrary read/write access to GPU memory and, crucially, enabling an escalation path into the CPU. Gururaj Saileshwar, an author of the study and an assistant professor at the University of Toronto, explained on LinkedIn that by flipping bits in GPU page tables an unprivileged process can obtain arbitrary GPU memory access and then chain that capability into a kernel-level compromise of the host via memory-safety flaws in NVIDIA’s driver, ultimately spawning a root shell.
What sets GPUBreach apart is that it operates without needing to turn off the input-output memory management unit (IOMMU) - a hardware layer intended to block DMA attacks by isolating device-visible memory regions. The researchers emphasize that corrupting driver-trusted state inside buffers the IOMMU allows can provoke out-of-bounds kernel writes, effectively sidestepping IOMMU protections even when it remains active.
RowHammer is a long-known DRAM reliability issue in which repeated activations of a memory row induce electrical disturbance that flips bits in neighboring rows (changing 0↔1). These induced bit errors undermine the isolation guarantees relied upon by operating systems and sandboxing. DRAM vendors have introduced hardware counters such as Error-Correcting Code (ECC) and Target Row Refresh (TRR) to mitigate this class of attack.
In July 2025, a University of Toronto team published GPUHammer, the first practical RowHammer method targeting NVIDIA GPUs that use GDDR6. GPUHammer overcame GPU architectural barriers that previously made bit-flips unlikely by using multi-threaded, parallel hammering approaches tailored to GPU hardware. One observed outcome of a successful GPUHammer attack was a significant fall in machine-learning model accuracy-up to roughly 80% in some workloads running on the affected GPU.
GPUBreach builds on those findings by using GDDR6-induced bit-flips to corrupt GPU page tables and gain arbitrary GPU memory read/write capabilities. From there, the attack can be escalated to leak sensitive data-researchers demonstrated exfiltration of secret cryptographic keys from NVIDIA cuPQC-mount model-accuracy-degradation attacks, and achieve CPU privilege escalation even with the IOMMU enabled.
Technically, the compromised GPU can issue DMA into a slice of host memory that the IOMMU has permitted (for example, buffers owned by the GPU driver) by manipulating aperture bits in page table entries (PTEs). By corrupting such trusted driver state, the exploit can trigger memory-safety vulnerabilities in the NVIDIA kernel driver to obtain an arbitrary kernel write primitive, which is then used to spawn a root shell.
The GPUBreach disclosure coincides with two other independent projects-GDDRHammer and GeForge-that also rely on GDDR6 RowHammer to corrupt GPU page tables and attain GPU-side privilege escalation and arbitrary read/write access to host memory. The approaches differ in subtle but important ways: GeForge requires the IOMMU to be turned off to succeed, while GDDRHammer works by changing the aperture field in a GPU page-table entry so a user-level CUDA kernel can read and write the entire host address space. According to the teams, GDDRHammer targets the last-level page table (PT) and GeForge targets the last-level page directory (PD0), yet both accomplish the same end goal of hijacking GPU translation to access GPU and host memory.
One short-term defensive step is to enable ECC on GPUs that support it, but the researchers warn this is not a silver bullet. Prior RowHammer variants such as ECCploit and ECC.fail have demonstrated ways to defeat ECC protections. If an attack induces more than two bit flips-an outcome shown feasible on some DDR4 and DDR5 systems-standard ECC cannot correct all errors and may even introduce silent data corruption. On many desktop and laptop GPUs, where ECC is absent, the researchers note there are currently no known mitigations.
The team warns that these findings have serious implications for cloud-based AI services, multi-tenant GPU hosting, and high-performance computing clusters where multiple users or workloads share GPU hardware. By demonstrating that GDDR6 RowHammer can be escalated into a full system compromise, GPUBreach highlights a new and urgent attack surface for GPU-accelerated environments.