GPUBreach: New GPU Rowhammer Attack Bypaches IOMMU for Full System Root Access

A critical vulnerability in NVIDIA GPUs has revealed that the hardware defenses we rely on to isolate system memory are not as foolproof as previously believed. Researchers have unveiled GPUBreach, a sophisticated attack that leverages GPU Rowhammer to achieve full CPU privilege escalation, effectively granting an attacker root access to a host machine.

While Rowhammer attacks have historically targeted CPU-side DDR memory, GPUBreach demonstrates that the GDDR6 memory used in modern NVIDIA GPUs is similarly fragile. By triggering targeted bit-flips, the attack bypasses the IOMMU—the industry-standard defense against DMA-based attacks—to compromise the entire system.

Understanding GPUBreach and the GPU Rowhammer Mechanism

GPUBreach is part of a new wave of research appearing at the 47th IEEE Symposium on Security & Privacy (IEEE S&P 2026). Developed by a team from the University of Toronto, the attack targets the inherent vulnerabilities of GDDR6 memory.

The attack follows a precise, multi-stage chain to move from an unprivileged process to full system control:

• GDDR6 Bit-Flips: The attacker uses Rowhammer techniques to cause bit-flips within the GPU’s GDDR6 memory.
• Page Table Corruption: These bit-flips are used to corrupt GPU page tables. Once these tables are compromised, the unprivileged process gains arbitrary read and write access to GPU memory.
• Driver Exploitation: The attackers then chain this memory access with existing memory-safety bugs in the NVIDIA driver.
• Privilege Escalation: By triggering kernel-level out-of-bounds writes, the attack spawns a root shell, granting the attacker total control over the host CPU.

Why the IOMMU Bypass is a Game Changer

The most alarming aspect of GPUBreach is its ability to bypass the Input-Output Memory Management Unit (IOMMU). The IOMMU is the primary hardware defense recommended by NVIDIA and AMD to prevent devices from accessing unauthorized areas of system memory. It has been deployed on commodity systems for over a decade to stop DMA-based attacks.

GPUBreach renders this defense insufficient. Instead of trying to disable the IOMMU, the attack corrupts trusted driver state within buffers that the IOMMU already permits. This allows the attacker to bypass protections entirely, proving that relying solely on IOMMU is not enough to secure a system against sophisticated GPU-based memory attacks.

Broader Impact: Cloud AI and Multi-Tenant Infrastructure

This vulnerability has serious implications for modern computing environments where GPUs are shared across multiple users or processes. The risk is particularly high in:

• Cloud AI Infrastructure: Where multiple tenants share powerful GPU clusters.
• Multi-tenant GPU Deployments: Where isolation between users is critical for security.
• High-Performance Computing (HPC) Environments: Where massive datasets and privileged access are common.

Because the attack can grant root access to the host machine, a single compromised guest or unprivileged user in a shared environment could potentially seize control of the entire server.

Concurrent Research: GDDRHammer and GeForge

GPUBreach is not the only discovery in this space. Two other concurrent research efforts, GDDRHammer and GeForge, also appear at IEEE S&P 2026. These teams similarly found that NVIDIA GPUs with GDDR6 memory—specifically those in the “Ampere” and “Ada Lovelace” families—are vulnerable to Rowhammer attacks.

While GDDRHammer and GeForge also target GPU page tables to gain control over host CPU memory, GPUBreach is distinguished by its ability to achieve full CPU privilege escalation even when the IOMMU is enabled.

Frequently Asked Questions

What is Rowhammer?

Rowhammer is a hardware vulnerability in DRAM where repeatedly accessing one row of memory can cause electrical leakage that flips bits in adjacent rows, allowing attackers to bypass memory isolation.

Which GPUs are affected?

Research indicates that NVIDIA GPUs utilizing GDDR6 memory are at risk, specifically mentioning the Ampere and Ada Lovelace families of cards.

Can the IOMMU stop this attack?

No. GPUBreach specifically demonstrates that it can bypass IOMMU protections by corrupting trusted driver state within permitted buffers.

Looking Ahead

The discovery of GPUBreach and its concurrent counterparts signals a shift in the cybersecurity landscape. As GPUs become central to both AI and general-purpose computing, they are becoming high-value targets for privilege escalation. The industry must now glance beyond the IOMMU to develop more robust memory isolation and driver-level protections to secure the next generation of AI infrastructure.