A newly discovered hardware attack technique called “GPUBreach” is raising serious concerns across the cybersecurity community, as it demonstrates for the first time that GPU-based Rowhammer attacks can lead to full system compromise, including a CPU-level root shell.
The research, conducted by a team from the University of Toronto and scheduled for presentation at the IEEE Symposium on Security & Privacy 2026, reveals how attackers can manipulate GPU memory structures to bypass traditional hardware protections and gain complete control over a system.
From Data Corruption to Full Takeover
Rowhammer attacks have traditionally targeted DRAM to induce bit flips, often resulting in limited data corruption.
Earlier GPU-based Rowhammer techniques mainly affected machine learning workloads, causing minor accuracy degradation. However, GPUBreach significantly escalates this threat.
Instead of random corruption, the attack precisely targets GPU page tables stored in GDDR6 memory.
These page tables are critical because they control how memory is mapped and accessed by GPU processes.
By reverse-engineering NVIDIA’s GPU driver, researchers discovered how these page tables are allocated alongside regular user data, opening the door for targeted manipulation.
The attack relies on a timing side-channel in NVIDIA’s Unified Virtual Memory (UVM) system. This allows attackers to detect when memory is allocated or evicted, helping them predict where page tables will be placed.
Attackers then carefully manipulate memory allocation patterns, forcing sensitive page table structures to sit next to vulnerable memory rows. Using a Rowhammer technique, they flip specific bits in these structures.
This single bit flip can modify a page table entry, granting an unprivileged CUDA process full read and write access to all GPU memory.
Real-World Impact
The researchers validated GPUBreach on an NVIDIA RTX A6000 GPU and demonstrated several high-impact attack scenarios:
- Extraction of cryptographic keys from NVIDIA’s cuPQC post-quantum library during active operations
- Silent manipulation of AI models, reducing accuracy from 80% to zero
- Theft of sensitive Large Language Model (LLM) weights directly from GPU memory
These capabilities highlight the growing risk to AI systems, cloud environments, and high-performance computing platforms.
One of the most critical aspects of GPUBreach is its ability to bypass the Input-Output Memory Management Unit (IOMMU), a key hardware security feature that restricts device access to system memory.
Unlike previous research that required disabling IOMMU, GPUBreach operates with it fully enabled.
Instead of attacking the hardware directly, the exploit targets trusted software pathways. The compromised GPU writes malicious data into memory buffers that are legitimately accessible under IOMMU policies.
When the NVIDIA kernel driver processes this corrupted data, it triggers memory-safety vulnerabilities, such as out-of-bounds writes. This ultimately allows attackers to escalate privileges and gain a full CPU root shell.
GPUBreach represents a major shift in hardware exploitation, demonstrating that GPUs are no longer isolated accelerators but potential entry points for full system compromise.
As GPUs play an increasingly central role in AI, cloud computing, and enterprise workloads, this research highlights the urgent need for stronger isolation mechanisms, improved driver security, and hardware-level defenses.
Security experts warn that this attack could have far-reaching implications if weaponized, particularly in shared GPU environments such as cloud platforms.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
.webp?fit=1600,900&ssl=1&description=The research, conducted by a team from the University of Toronto and scheduled for presentation at the IEEE Symposium on Security & Privacy 2026){kind=link}