GPUBreach: Rowhammer Hits NVIDIA GPUs, Bypasses IOMMU in AI Cloud Deployments

Black Hat USA 2026 opened August 1 in Las Vegas with a finding that changes the threat model for shared GPU infrastructure: GPUBreach, presented by researchers from the University of Toronto, demonstrates the first Rowhammer attack on NVIDIA GDDR6 GPU memory that achieves a host root shell with IOMMU enabled.

The research had also been accepted at IEEE Symposium on Security and Privacy 2026. Its arrival at Black Hat means it received a keynote slot rather than the quieter academic-paper treatment, which reflects how directly relevant the researchers and conference organisers judged it to be for the security practitioner community.

What Rowhammer on GPUs Actually Means

Rowhammer is a hardware vulnerability class that exploits the physical properties of dynamic RAM. Repeatedly reading from a memory row at high frequency causes bit-flips in adjacent rows. What was originally a CPU DRAM attack vector has migrated over years of research to target GPU memory.

GPUBreach targets GDDR6, the memory type used in modern NVIDIA data centre and consumer GPUs including A100, H100, and RTX-series cards. The attack chain works in two stages.

First, the researcher’s CUDA kernel hammers specific GDDR6 memory rows to induce bit-flips in GPU page tables. These are the structures that control which GPU memory is accessible to which kernel or process. A successful bit-flip in a page table entry gives the attacker’s CUDA kernel arbitrary read and write access to GPU memory outside its allocated region, including memory belonging to other processes or contexts sharing the same physical GPU.

Second, the researchers discovered memory-safety bugs in the NVIDIA GPU driver itself, running on the host CPU. Using the arbitrary GPU memory access obtained in stage one, they wrote crafted data that exploited these driver bugs, resulting in privilege escalation from the GPU context up to a host root shell.

The IOMMU Problem

The piece that distinguishes GPUBreach from two concurrent publications, GDDRHammer and GeForce (both presented at IEEE S&P 2026), is IOMMU bypass.

Input-Output Memory Management Unit hardware exists specifically to prevent DMA-capable devices like GPUs from accessing host memory outside their allocated regions. When IOMMU is enabled, the hardware enforces a boundary between GPU and host memory at the silicon level. This is why prior GPU Rowhammer research, including GDDRHammer, was framed as requiring IOMMU to be disabled. Disabled IOMMU is rare in production. It is, essentially, a research-conditions-only constraint that limits real-world relevance.

GPUBreach bypasses IOMMU by exploiting the driver rather than attempting to cross the IOMMU boundary directly. The NVIDIA kernel driver runs with host CPU privileges and has legitimate access to both GPU and host memory. By exploiting the driver’s memory-safety bugs through the GPU, the attack sidesteps the IOMMU entirely. You do not cross the boundary you route through something that is already on both sides of it.

That is the attack that matters in production AI cloud deployments.

Why AI Infrastructure Is Specifically at Risk

The AI industry has built its infrastructure on shared GPU hardware. Cloud providers including AWS, Google Cloud, and Azure offer GPU instances where the physical hardware is shared between customers at the hypervisor level. Kubernetes-based AI platforms run training and inference pods across shared GPU node pools. HPC clusters at research institutions and enterprises pack multiple tenants onto the same GPU systems.

In all of these configurations, an attacker who can submit a workload that runs on the same physical GPU as a target has, after GPUBreach, a demonstrated path to host root.

Host root on a cloud GPU node can mean access to all other pods on that host, to the node’s cloud credentials (instance metadata API), to co-resident training jobs, and to any model weights or datasets mounted into the host’s filesystem. If the target is a language model training job handling proprietary data, that data is reachable from a root shell.

The attack requires submitting a workload that runs on the target GPU. In a shared cloud context, this means an adversary would need a customer account on the same cloud platform and enough luck or control to land a workload on the same physical node. That is not trivial, but it is also not theoretical. Co-tenancy attacks have been demonstrated against cloud CPU infrastructure since at least 2009. GPU infrastructure, until now, was considered safer because IOMMU was assumed to hold.

Responsible Disclosure and Current Status

The University of Toronto team followed coordinated disclosure procedures with NVIDIA. NVIDIA acknowledged the driver-level memory-safety vulnerabilities. At the time of Black Hat presentation, NVIDIA had not yet released driver patches addressing the specific bugs used in the GPUBreach exploit chain. Security teams should monitor NVIDIA’s security bulletin feed for updates.

The Rowhammer aspect of the attack, at the GDDR6 hardware level, is not patchable via driver update. Hardware-level mitigations exist and are used in some DRAM configurations, but GDDR6 does not currently implement equivalent protections. This is a research problem that GPU vendors and standards bodies will need to address at the memory controller and GDDR specification level over a longer horizon.

For teams running AI workloads on shared infrastructure, the practical response is workload isolation, not waiting for hardware mitigations that do not yet exist.

References

• GBHackers — GPUBreach Attack Could Lead to Full System Takeover and Root Shell Access
• BleepingComputer — New GPUBreach Attack Enables System Takeover via GPU Rowhammer
• CSA Labs — GPUBreach: GDDR6 RowHammer Achieves Full System Compromise
• TechTimes — Black Hat USA 2026: Rowhammer Hits NVIDIA GPUs
• VideoCardz — GPUBreach is the Third GPU Rowhammer Attack, Can Bypass IOMMU
• GPUBreach Project Site