Ruben Boekeloo/pexels.com

Three open-source Linux projects have exposed and removed a deliberately imposed performance restriction inside Nvidia's consumer RTX graphics cards, using a firmware vulnerability in the GPU's own secure coprocessor to unlock Tensor Core throughput that Nvidia had reserved for its professional product line. The modification, which went viral across GPU enthusiast communities in the past week and is now drawing attention from the broader AI infrastructure community, delivers up to 80% higher AI matrix-math throughput on RTX 30-series cards used for local inference workloads — though the benefit applies only to the compute-bound half of the inference pipeline, not to the memory-bandwidth-bound token generation that most users experience as "speed."

What makes the story more significant than a typical enthusiast mod is what it reveals about how Nvidia has structured consumer GPU performance since 2000: not around what the silicon can do, but around what Nvidia's market segmentation model permits it to do. The Quadro product line, Nvidia's long-running professional graphics brand, was built on the same principle — identical chips running at different capability levels depending on which firmware configuration was shipped. The Tensor Core throttle on consumer RTX cards is the AI-era version of the same approach, now being broken open by three parallel projects targeting RTX 20, 30, and 40 series hardware.

Nvidia Has Throttled Identical Silicon Since the Turing Era

The performance gap in question is not a difference in hardware. Consumer RTX cards share silicon dies with their professional counterparts: the RTX 3090 is built on the same GA102 die as the Nvidia RTX A6000; the RTX 4090 shares the AD102 die with the RTX 6000 Ada Generation. Yet on consumer cards, Tensor Core operations that multiply FP16 or BF16 numbers and accumulate the results in FP32 — the dominant precision pattern in large language model inference and AI image generation — have run at half the instruction-issue rate of professional cards since at least the Turing architecture launch in 2018.

The restriction is enforced not in silicon but in speed-selector registers controlled by Nvidia's signed Booter firmware, which runs on the GPU's SEC2 secure coprocessor. Nvidia's standard driver initializes these registers to consumer rates at boot. The driver cannot write to them directly; only code running in the GPU's "heavy secure" execution mode can.

This is what the modding projects changed — and the mechanism they used to change it matters.

How a Firmware Stack Overflow Became a Performance Mod

The exploit at the center of these projects was documented by security researcher Jon Pry in a paper titled "A Canary in the Crypto Mine: Defeating Stack Protection in a GPU Secure Coprocessor," published on Zenodo in June 2026. Pry found that Nvidia's signed SEC2 Booter firmware contains a stack buffer overflow vulnerability, first discovered on the CMP 170HX mining card after Nvidia published a debug version of the Booter encrypted with a known public test key. A four-byte write using the "V67 payload" exploits the overflow to execute code in heavy secure mode — long enough to open the privilege mask and write full professional-grade instruction rates to the speed-selector registers.

Zagitta, the developer behind gpu-unlock for RTX 30-series cards, acknowledged on Hacker News that the project is their work but that "the exploits… aren't my ideas by any means" and that the unlock just flips the two bits needed. The underlying research traces to WildFlash1st's CMP 90HX unlock work and to Pry's subsequent formalization of the exploit's mechanism.

This distinction matters for both security and longevity. The modification does not patch or replace Nvidia's driver. Instead, a Linux kernel module loads during the initramfs boot phase — before Nvidia's driver has claimed the GPU — performs the firmware-level register write, resets the card, and then exits. When Nvidia's unmodified driver subsequently initializes, it finds a GPU already running at professional rates and operates normally. No VBIOS flash. No driver modification. No DKMS patches to maintain across driver updates.

Because the restriction lives in the GPU's secure coprocessor firmware rather than in an ordinary driver register, Nvidia would need to update the Booter firmware — and potentially invalidate compatibility with existing signed firmware versions — to close this path. Driver updates alone are unlikely to reverse the modification.

Three Projects, Three GPU Generations

The modding effort currently spans three linked repositories, each targeting a different architecture:

RTX 30 series (Ampere): gpu-unlock by Zagitta covers GA102, GA103, GA104, and GA106 chips, encompassing the RTX 3090 Ti, 3090, 3080 Ti, 3080, 3070 Ti, 3070, and the 12 GB RTX 3060. Version 1.0.0 ships under the GPL-2.0 license and integrates directly into initramfs on supported distributions via DKMS. In benchmarks run with the developer's matrix-multiply test suite, an RTX 3090 Ti at 450 watts showed BF16 throughput climbing from 87.5 to 157.4 TFLOPS — a gain of approximately 80%. FP16 rose by 35% and TF32 nearly doubled. Community-reported BF16 gains across other supported cards ranged from approximately 25% (RTX 3090 at a 225-watt power cap) to 81% (RTX 3070).

RTX 40 series (Ada Lovelace): gpu-unlock-ada for Ada Lovelace by GitHub user JustAResearcher extends the technique to Ada hardware, with the RTX 4090 as the primary tested device and the RTX 4090 D, RTX 4070 Ti Super, and RTX 4060 Ti 16 GB as experimental targets. On the RTX 4090, the raw FP16 instruction-issue rate doubled from 165.6 to 331.6 TFLOPS. Real matrix-multiply benchmarks from an independent owner running on Linux at the card's 450-watt limit showed cuBLAS GEMM gains of 12–34% for FP16 and up to 20% for BF16 — meaningfully less than the peak rate doubling would suggest, because real workloads do not achieve perfect instruction saturation.

RTX 20 series (Turing): turing-unlock for RTX 2080 Ti by GitHub user nlzy targets the RTX 2080 Ti, with testing conducted primarily on 22 GB memory-modded variants of the card that have become popular among budget-conscious AI builders. Turing hardware lacks dedicated BF16 circuitry, so gains are FP16-only. Matrix-multiply tests on a Dell OEM RTX 2080 Ti 22 GB at 250 watts showed improvements of 36–64% depending on matrix size; a 260-watt variant achieved 59%. The turing-unlock README carries a direct caution: the modification "may damage your hardware." A related Windows-oriented project, KohakUnlock, tested on a Leadtek RTX 2080 Ti 22 GB and achieved a best matrix-multiply median of 53% versus a locked reference card — but adds a starker warning that the mod can hang or brick hardware.

RTX 50 (Blackwell) cards are explicitly out of scope. Zagitta stated that Hopper and Blackwell GPUs are "out of scope for this approach" at least under the current exploit path.

What Actually Gets Faster — and What Does Not

The benchmark improvements above are real, but they apply only to compute-bound operations. Understanding which workloads benefit and which do not requires understanding the fundamental split in how LLM inference works.

When a large language model processes a prompt — a user's input before any output is generated — the GPU must multiply large matrices against each other. This is a compute-bound operation: the bottleneck is how fast the Tensor Cores can dispatch FP16/BF16 instructions. The unlock directly accelerates this stage. Community testing on RTX 3090-class hardware reported prompt-processing speed improvements of 14–36% in real LLM inference tasks.

When the same model generates output tokens — the streaming words a user sees appearing after the prompt — the bottleneck shifts to memory bandwidth. The model's weights must be read from GDDR6X memory for each token produced. An RTX 3090 has 936 gigabytes per second of memory bandwidth, and no firmware modification changes that number. Token generation speed therefore remains essentially unchanged. For conversational use cases where the user spends most of their waiting time watching tokens stream out, the unlock will feel like little to no improvement.

The workloads that benefit most are those that are compute-intensive rather than memory-read-intensive: AI image generation pipelines running BF16 models, LLM fine-tuning on the local machine, and long-context prompt processing. One community test on a ComfyUI pipeline showed throughput gains of 47–60% on BF16-heavy workloads. A test of the MiniMax H3 video-and-audio generation model reported 60% higher throughput in BF16 mode and 31% in INT8 mode. INT8 operations are not improved by the unlock.

What Happens If Nvidia Pushes Back

Nvidia has not commented publicly on the projects. The company's driver updates have in the past introduced countermeasures against hardware modifications that alter GPU behavior outside official channels.

Whether Nvidia will respond here is a more open question than in typical mod cases. A driver-level patch would not be sufficient, since the unlock occurs at the firmware/bootloader level before the driver loads. Closing the V67/PLM exploit path would require updating the signed Booter firmware — a more involved change that affects firmware compatibility across the entire affected GPU ecosystem. The exploit also originated from Nvidia's own publication of a debug Booter with a known test key, which is unlikely to be repeated. The most probable countermeasure, if Nvidia chooses to act, would be a future Booter firmware update shipping with new driver packages.

Until then, the mod appears stable. Across reported testing sessions, no Xid errors, GSP firmware timeouts, or device failures were documented. GPU power management and thermal throttling remain active; the modification changes only the instruction-issue rate, not the card's power or thermal limits.

Applying any of the three modifications voids the GPU's warranty.

Does Nvidia Have to Throttle Consumer Cards?

The restriction these mods remove is not unique to AI compute. It is the latest iteration of a segmentation model Nvidia introduced with the Quadro line in 2000. According to Wikipedia's documentation of the Quadro history, Nvidia used "driver software and firmware to selectively enable features vital to segments of the workstation market" in the Quadro product line while withholding them from the consumer GeForce line — on identical silicon. The Tensor Core instruction-issue rate restriction follows the same logic: the hardware is capable, the firmware restricts it, and the differential between consumer and professional pricing justifies the restriction to Nvidia's shareholders.

The open-source community has broken variants of these restrictions repeatedly. The vGPU virtualization unlock, which allowed consumer GPUs to run virtual machine workloads reserved for datacenter cards, appeared in various forms beginning around 2021. The CMP 170HX mining card unlock that provided the foundational exploit technique for these current projects was published in 2022. The current projects represent the first systematic application of the same underlying firmware vulnerability specifically to the Tensor Core performance gap — and the first time the effort has targeted the AI inference use case that now defines why many people own RTX 3090-class hardware in the first place.

How Much Does a Used RTX 3090 Cost Now?

Secondhand RTX 3090 cards traded on the used market for approximately $800–$1,050 as of early 2026, according to consumer hardware guides tracking the category. With 24 gigabytes of GDDR6X memory and the largest VRAM pool available in a consumer GPU during the Ampere era, the RTX 3090 became the default recommendation for users running large language models locally — even before this unlock appeared. The unlock's effect on that market positioning is real: a used RTX 3090 running at professional Tensor Core rates on Linux is meaningfully closer to an RTX A6000 for AI inference workloads than Nvidia's official specifications would suggest.

The effect is conditional. It requires Linux. It requires willingness to install an experimental kernel module with no stability guarantees, a warranty void, and documented hardware risk warnings from at least two of the three projects. Compatibility gaps remain — GA103 cards have not been confirmed, one OEM RTX 3080 Ti 20 GB completed the install but showed no BF16 improvement, and RTX 40 series support is more experimental than the Ampere coverage.

Is This Safe to Install on Your GPU?

The hardware risk question has split opinions among the three projects. Zagitta, the gpu-unlock developer, considers damage "very unlikely" because the GPU's normal power management and thermal controls remain in place; the modification only changes how fast Tensor Cores issue instructions, not how much power they draw at a given thermal limit. The turing-unlock README takes the opposite view, explicitly warning "may damage your hardware" on the grounds that Tensor Cores draw substantial power when running at maximum instruction rate, and sustained maximum-rate operation on older hardware is a genuine thermal risk. KohakUnlock's caution — "can hang a GPU or host, prevent boot, corrupt data, or damage hardware" — applies more to Windows-oriented approaches that use a different loading mechanism.

The practical risk profile also depends on your GPU model, power cap, and cooling setup. The RTX 3090 Ti results above were measured at 450 watts with the card adequately cooled; the lowest BF16 gains (+25% on the RTX 3090) corresponded to cards running at a 225-watt power cap, where power limits constrained how much of the unlocked throughput the card could actually sustain.

These modifications are aimed at technically sophisticated Linux users with hardware they are willing to run experimentally. They are not plug-and-play upgrades for general users.

Frequently Asked Questions

Does unlocking Tensor Core throughput make LLM chatbots generate tokens faster?

No — and this is the most important nuance the headline numbers can obscure. Token generation, the process of streaming each word of a model's response, is limited by memory bandwidth rather than compute throughput. The RTX 3090's 936 gigabytes-per-second of GDDR6X memory bandwidth is unchanged by this modification. The unlock accelerates prompt processing (how fast the model digests your input) and training/fine-tuning workloads. For a typical chat session, the improvement will be noticeable mostly on long, complex prompts — not on the moment-to-moment token speed.

Why does Nvidia limit consumer GPU AI performance in the first place?

The Tensor Core instruction-issue rate restriction is part of Nvidia's decades-old market segmentation model. Consumer RTX cards share identical silicon with professional RTX Pro/Workstation cards, but professional cards are sold at a significant price premium. Nvidia maintains the price gap by firmware-gating certain capabilities — including full Tensor Core throughput — so that professional buyers, who need guaranteed professional-grade compute for commercial and research workloads, cannot simply buy a gaming card and get the same performance. This practice dates to Nvidia's Quadro product line, introduced in 2000 using the same software-and-firmware differentiation principle on identical chips.

Is gpu-unlock safe to install, and does it affect gaming performance?

Safety varies by project and hardware generation. The gpu-unlock developer considers hardware damage unlikely because power and thermal management stay in place; the turing-unlock README explicitly warns the mod "may damage your hardware." All three projects currently target Linux only (experimental Windows ports exist but are not production-ready). Installing any of the modules voids your GPU's warranty. For gaming, the unlock is likely irrelevant: games do not use the FP16/BF16 with FP32 accumulation mode that the restriction targets. DLSS uses Tensor Cores, but in modes not affected by this throttle.

What GPUs work with the unlock, and what about RTX 50 (Blackwell)?

RTX 30 series cards on GA102/GA103/GA104/GA106 silicon are the best-supported generation under gpu-unlock, with community-confirmed results across the RTX 3090 Ti, 3090, 3080, 3070, and 3060 12 GB. RTX 40 series support under gpu-unlock-ada is functional but more experimental, with the RTX 4090 as the primary tested card. RTX 20 series (Turing) support via turing-unlock is limited to the RTX 2080 Ti, particularly 22 GB memory-modded variants. RTX 50 (Blackwell) and Hopper-architecture cards are explicitly out of scope — the underlying exploit path does not apply to those architectures. Some RTX 30 cards have known compatibility gaps: GA103 results have not been confirmed, and one OEM RTX 3080 Ti 20 GB completed installation but showed no performance improvement.