Affected Systems

NVIDIA Ampere-class workstation GPUs with GDDR6 memory: RTX A4000, RTX A4500, RTX A5000, RTX A6000. Server-class A100 GPUs vulnerable to privilege escalation. Blackwell GPUs with RAS Repair feature remain vulnerable but attack is more time-consuming. GDDR6X and HBM2e GPUs showed no bit flips in testing.

Exploitation Status

Proof-of-concept demonstrated by University of Toronto researchers. Attack achieves exploitable bit flip within 1.1 minutes. No evidence of active in-the-wild exploitation. NVIDIA notified April 29, 2026; advisory published August 21, 2026.

Business Impact

GPUThor enables two attack vectors: (1) denial-of-service causing GPU reset every two hours and eventual hardware failure marking, terminating AI training and cloud workloads; (2) root-level privilege escalation via GPU page table corruption, allowing unprivileged CUDA programs arbitrary memory access and host system compromise. Critical risk for multi-tenant GPU cloud environments, AI training infrastructure, and shared workstation deployments. Attack bypasses SECDED ECC by generating 387 uncorrectable double-bit errors and 2 incorrectly-corrected triple-bit errors. No CVE assigned.

Urgency

🟡 Within a week

Recommended Actions

  • Enable both SYS-ECC and IOMMU/DMA isolation on all NVIDIA Ampere and Blackwell GPUs per NVIDIA advisory dated August 21, 2026
  • Implement continuous monitoring of GPU error telemetry and ECC error counters; alert on double-bit and triple-bit error spikes
  • Eliminate cross-tenant GPU sharing in cloud and virtualized environments; dedicate GPUs to single trusted workloads
  • Restrict execution of untrusted CUDA workloads; enforce code signing and workload validation for all GPU compute tasks
  • Prioritize migration from GDDR6-based RTX A-series GPUs to GDDR6X or HBM2e models where no bit flips were observed in testing