NEW DELHI: Every security framework India has built around its national AI infrastructure assumes that software defines the boundary between one user’s data and another’s. Firewalls, encryption, container isolation and hypervisor partitioning all operate on this assumption. In April 2026, three research disclosures from the University of Toronto proved that assumption is physically wrong and that the proof of concept runs on the same NVIDIA hardware that powers India’s sovereign AI ambitions.
What Rowhammer Is and Why It Has Reached GPU Hardware
Rowhammer is not a software vulnerability it is a physical property of how modern memory chips are built. Dynamic random-access memory stores data as electrical charges in microscopic capacitor cells arranged in rows. As manufacturing processes have scaled down to sub-nanometer dimensions, these cells are packed so tightly together that repeatedly accessing one row at high speed causes voltage fluctuations that leak charge into neighbouring rows. If enough charge leaks before the memory controller executes its refresh cycle, a bit in an adjacent row flips its value from one to zero or vice versa. The attacker writes nothing to the target memory. They simply hammer the rows next to it until physics does the rest.
Originally documented in CPU system RAM in 2014, Rowhammer reached mobile integrated GPUs in 2018 through the GLitch attack developed at Vrije Universiteit Amsterdam which escaped browser sandboxes in under two minutes using standard WebGL calls. The same year, Throwhammer demonstrated that bit flips could be induced remotely across high-speed network connections without any local code execution on the victim machine. By 2025 researchers at the University of Toronto had demonstrated the first successful Rowhammer attack on discrete high-performance graphics cards using GDDR6 memory, specifically the NVIDIA RTX A6000. That attack named GPUHammer and published at USENIX Security Symposium 2025, showed that flipping a single bit in a neural network’s weight parameters could collapse its classification accuracy from 80 percent to 0.1 percent what the researchers called catastrophic brain damage to the model.
The April 2026 Escalation: From Data Corruption to Complete Machine Control
GPUHammer proved the concept. Three disclosures on April 2 and 3, 2026 proved the catastrophe. GDDRHammer and GeForge disclosed simultaneously by independent academic teams demonstrated that GDDR6-based Rowhammer could be executed from an unprivileged CUDA kernel to achieve complete system-wide host compromise. The mechanism exploits a specific weakness in NVIDIA’s default memory manager, cudaMalloc which co-locates GPU page tables in the same physical GDDR6 memory region as unprivileged user data. An attacker uses memory-massaging techniques to position their GPU page table entries next to physically vulnerable memory rows, then hammers those rows until a single bit flips in the Page Frame Number field of a page table entry. That one bit flip redirects the GPU’s virtual memory mapping to point at physical host CPU memory through the PCIe interface, granting the attacker arbitrary direct memory access to the entire host system. The result is a root shell with full administrative privileges over the machine.
GeForge operates one level higher in the address translation hierarchy, targeting page directory entries rather than individual page tables. Because a single directory entry maps to entire page tables rather than individual data pages, corrupting it provides a broader and more efficient control mechanism. GDDRHammer recorded over 100 bit flips per memory bank. GeForge recorded 1,171 flips on the RTX 3060 and 202 on the RTX A6000.
The primary hardware defence against these attacks is the Input-Output Memory Management Unit, a hardware enforcer that restricts peripheral devices from accessing system memory outside designated buffers. GDDRHammer and GeForge require the IOMMU to be disabled to complete their attack chain. On April 3, 2026 GPUBreach closed that escape route. The University of Toronto team demonstrated that GPUBreach achieves full system compromise even with the IOMMU enabled. It does this by combining physical bit flips with software memory-safety vulnerabilities in the NVIDIA host driver. Rather than attempting unauthorised direct memory access that the IOMMU would block, GPUBreach corrupts metadata within the memory buffers the IOMMU has legally permitted the GPU to access. The host NVIDIA driver then processes this corrupted metadata using its kernel-level privileges, executing out-of-bounds writes into CPU kernel structures on the attacker’s behalf. The hardware boundary and the software driver cannot be secured independently of each other. GPUBreach proves they must be secured together.
India’s Exposure Is Structural, Not Incidental
India has deployed over 38,000 NVIDIA GPUs under the IndiaAI Mission’s compute pillar, with AI Mission 2.0 planning to expand this pool to 100,000 units by end-2026. To make this infrastructure fiscally efficient it operates as shared multi-tenant compute offering subsidised access to startups, researchers and public institutions at Rs 65 to Rs 150 per hour. Sarvam AI alone received a Rs 98.68 crore subsidy to deploy 4,096 NVIDIA H100 SXM GPUs on this shared infrastructure.
In a multi-tenant environment, the Rowhammer threat is not theoretical. An attacker registers as a benign startup, claims subsidised compute credits and executes an unprivileged CUDA hammering loop from within their allocated container. Once successful they can scrape VRAM from co-resident tenants extracting proprietary model weights including India’s 17-billion-parameter BharatGen foundation model or Sarvam AI’s Pravah. They can extract active cryptographic keys from post-quantum cryptography libraries running on shared hardware. They can corrupt long-running simulations on C-DAC’s 410-petaflop AIRAWAT cluster at Pune. Private sector exposure is equally direct. Yotta Data Services’ NM1 facility in Navi Mumbai operates over 20,000 NVIDIA Blackwell Ultra GPUs on its Shakti Cloud sovereign infrastructure. Reliance is building a 1 gigawatt AI data centre in Gujarat on NVIDIA Blackwell chips for its JioBrain platform serving 450 million users.
The Legal Dimension
The Digital Personal Data Protection Act 2023 classifies any entity processing Indian citizens’ personal data as a Data Fiduciary with a non-delegable obligation to implement reasonable security safeguards. The Data Protection Board of India can levy penalties of up to Rs 250 crore for breaches resulting from failure to meet this standard. Because GDDRHammer and GPUBreach bypass software-defined access barriers to read raw physical memory, software-only encryption architectures where cryptographic keys reside in volatile server RAM are increasingly indefensible under this standard. If an attacker uses a documented, publicly disclosed hardware vulnerability to extract those keys and access personal data, a software-only security posture will not constitute a reasonable safeguard before the DPBI.
CERT-In’s May 2026 guidelines compound this urgency by mandating that high-severity vulnerabilities affecting critical business systems be patched within five days. CVE-2026-24187, a use-after-free vulnerability in the NVIDIA GPU display driver carrying a CVSS score of 8.8 and CVE-2025-33220, a heap use-after-free in NVIDIA’s virtual GPU manager carrying a CVSS score of 7.8, are precisely the software entry points that GPUBreach chains with physical bit flips to achieve its IOMMU bypass. Leaving either unpatched beyond the five-day window while operating a multi-tenant GPU environment is both a security failure and a legal exposure.
What Mitigation Actually Requires
Enabling System-Level ECC memory across all deployed data centre GPU hardware is the immediate operational requirement. ECC reserves approximately 6.25 percent of VRAM for parity bits and introduces a 5 to 15 percent performance overhead but allows the memory controller to detect and correct single-bit flips automatically. Future procurement under the IndiaAI Mission and private data centre programmes should mandate hardware using GDDR6X, GDDR7 or HBM3 and HBM4 memory standards which incorporate native On-Die ECC within the memory silicon itself eliminating the processing penalty entirely.
Enabling BIOS-level IOMMU protections is mandatory for any multi-tenant GPU deployment. It is disabled by default in many configurations for legacy compatibility reasons. In a shared sovereign AI computing environment that default is indefensible. NVIDIA driver patches for high-severity CVEs must be deployed within CERT-In’s five-day mandate without exception since GPUBreach’s attack chain depends on finding unpatched driver memory-safety flaws. Cryptographic key management for all sensitive public-sector AI workloads must transition to FIPS 140-2 Level 3 certified Hardware Security Modules, establishing a hardware root of trust that physical memory scraping cannot reach.
The Strategic Question India Cannot Defer
India is building AI sovereignty on hardware from a single foreign vendor, procured under US export control restrictions that cap cumulative H100-class imports at approximately 50,000 units through 2027. That hardware carries documented class-level physical vulnerabilities. C-DAC is developing indigenous alternatives a 96-core ARM-based AUM processor and plans for a domestic AI-focused GPU but commercial production remains years away. In the interim the answer is not to halt procurement. It is to build the hardware security framework that the procurement programme currently lacks. MeitY should establish mandatory procurement standards requiring ECC enablement and IOMMU enforcement for all public-sector multi-tenant GPU deployments. India Semiconductor Mission 2.0 research funding should include hardware-level Rowhammer mitigations in the co-design brief for indigenous processors. The silicon is not secure by assumption it must be made secure by policy.
About the Author
