**GPUBreach** allows attackers to induce Rowhammer bit-flips on GPU GDDR6 memories to escalate privileges and lead to a full system compromise. The attack, developed by researchers at the University of Toronto, will be presented at the upcoming IEEE Symposium on Security & Privacy on April 13 in Oakland. The researchers demonstrated that Rowhammer-induced bit flips in GDDR6 can corrupt GPU page tables (PTEs) and grant arbitrary GPU memory read/write access to an unprivileged CUDA kernel. An attacker may then chain this into a CPU-side escalation by exploiting memory-safety bugs in the **NVIDIA** driver, potentially leading to complete system compromise without disabling **Input-Output Memory Management Unit (IOMMU)** protection. <div><figure><img width="900" src="https://www.bleepstatic.com/images/news/u/1220909/2026/April/steps.jpg" height="224" alt="GPUBreach attack steps"><figcaption><strong>GPUBreach attack steps</strong><br><em>Source: University of Toronto</em></figcaption></figure></div> IOMMU is a hardware unit that protects against direct memory attacks. It controls and restricts how devices access memory by managing which memory regions are accessible to each device. Despite being an effective measure against most direct memory access (DMA) attacks, IOMMU does not stop GPUBreach. “GPUBreach shows that GPU Rowhammer attacks can move beyond data corruption to real privilege escalation,” the researchers explain. “By corrupting GPU page tables, an unprivileged CUDA kernel can gain arbitrary GPU memory read/write, and then chain that capability into CPU-side escalation by exploiting newly discovered memory-safety bugs in the NVIDIA driver.” “The result is system-wide compromise up to a root shell, without disabling IOMMU, unlike contemporary works, making GPUBreach a more potent threat.” <div><figure><img src="https://www.bleepstatic.com/images/news/u/1220909/2026/April/overview.jpg" data-src="https://www.bleepstatic.com/images/news/u/1220909/2026/April/overview.jpg" width="664" height="405" alt="Overview of how GPUBreach works"><figcaption><strong>Overview of how GPUBreach works</strong><br><em>Source: University of Toronto</em></figcaption></figure></div> The same researchers previously demonstrated **GPUHammer**, the first attack showing that Rowhammer attacks on GPUs are practical, prompting NVIDIA to issue a warning to users and suggesting the activation of the System Level Error-Correcting Code mitigation to block such attempts on GDDR6 memory. However, GPUBreach is taking the threat to the next level, showing that it is possible not only to corrupt data but also to gain root privileges with IOMMU enabled. The researchers exemplified the results with an **NVIDIA RTX A6000 GPU** with GDDR6. This model is widely used in AI development and training workloads. <div><figure><img src="https://www.bleepstatic.com/images/news/u/1220909/2026/April/compare.jpg" data-src="https://www.bleepstatic.com/images/news/u/1220909/2026/April/compare.jpg" width="661" height="366" alt="Comparison to other attacks"><figcaption><strong>Comparison to other GPU attacks</strong><br><em>Source: University of Toronto</em></figcaption></figure></div> ### Disclosure and mitigations The University of Toronto researchers reported their findings to NVIDIA, **Google**, **AWS**, and **Microsoft** on November 11, 2025. Google acknowledged the report and awarded the researchers a $600 bug bounty. NVIDIA stated that it may update its existing security notice from July 2025 to include the newly discovered attack possibilities. As demonstrated by the researchers, IOMMU alone is insufficient if GPU-controlled memory can corrupt trusted driver state, so users at risk should not rely solely on that security measure. Error Correcting Code (**ECC**) memory helps correct single-bit flips and detect double-bit flips, but it is not reliable against multi-bit flips. Ultimately, the researchers underlined that GPUBreach is completely unmitigated for consumer GPUs without ECC. The researchers will publish the full details of their work, including a technical paper and a GitHub repository with the reproduction package and scripts, on April 13. NVIDIA told BleepingComputer that, for enterprise customer environments, they recommend enabling System Level Error-Correcting Codes to prevent Rowhammer-style attacks. This is enabled by default on the Hopper and Blackwell Data Center class of GPUs.