Arm bug bounty programs
arm.com Updated
Arm runs three public programs: an Intigriti bug bounty paying up to $20,000, a Sorona bug bounty paying up to $10,000 and a self-hosted bug bounty. It also owns mbed.org, which runs one more program.
- Top reward
- $20,000
- Intigriti
- Programs
- 4
- 4 pay cash
- Targets in scope
- 13
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs Arm runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Arm
Intigriti · The company-wide program. Pays up to $20,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Arm
Intigriti · Bug bounty |
$20k (highest) | $10k (highest) | $3,000 (highest) | $1,000 (highest) | $20,000 | Full | – | – | Open |
|
Arm Mali GPU Kernel Driver
Sorona · Bug bounty |
$10k | $5,000 | $1,500 | $500 | $10,000 | Partial | – | – | Open |
|
Arm
Self-hosted · Bug bounty |
– | – | – | – | Not published | – | – | 2 days promised | Open |
-
- Critical
- $20k (highest)
- High
- $10k (highest)
- Medium
- $3,000 (highest)
- Low
- $1,000 (highest)
- Safe harbor
- Full
-
- Critical
- $10k
- High
- $5,000
- Medium
- $1,500
- Low
- $500
- Safe harbor
- Partial
-
- First response
- 2 days promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Arm owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
13 targets across all 4 programs, each listed once with the programs that cover it. 8 excluded.
-
Arm's program welcomes vulnerability reports in certain versions of two named assets: the Mali GPU Kernel Driver (Kbase) and the Mali Command Stream Frontend firmware (CSFFW). Kbase is the GPL-2.0 kernel module this entry covers, and it is the asset the $500 to $10,000 tier maps to
Products and areas
Covered by Sorona
-
Context and file-descriptor lifecycle, power and clock management, and the kernel-side interface to the CSF firmware
Products and areas
Covered by Sorona
-
GPU memory management: allocation and growable regions, mapping into user and GPU address spaces, imported user buffers and dma-bufs, and the MMU and page-table handling underneath
Products and areas
Covered by Sorona
-
Job and command submission on both generations, the job-manager path on older parts and the queue and group path on CSF hardware, along with fence, timeline and event delivery back to userspace
Products and areas
Covered by Sorona
-
The CSF firmware itself, which the same program covers as a separate asset on a higher tier, though it is proprietary rather than part of the open-source driver
Products and areas
Covered by Sorona
-
The program's eligibility shape is part of what it accepts: the attack must be local, unprivileged and mounted from EL0 with proof-of-concept code, and it must reproduce on an unmodified driver, including the CONFIG_MALI_NO_MALI=y virtual setup Arm documents for researchers without hardware
Products and areas
Covered by Sorona
-
The whole Kbase module as Arm publishes it, starting at the /dev/mali device node and its ioctl surface, which any application holding a GPU handle can reach
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 8
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Bugs only reachable through debugfs, through privileged sysfs or procfs files an unprivileged attacker could not open, through TEST config options, or in the dummy model code
Sorona
-
Issues Arm already knows about, closed as duplicates, and zero-days reported within 14 days of a public patch or mitigation
Sorona
-
Local temporary denial of service that a reboot resolves, and theoretical issues with no realistic exploit scenario or attack surface
Sorona
-
Sanctioned-country residents and anyone under 18, who cannot be paid
Sorona
-
Side-channel and covert-channel attacks, fingerprinting-style privacy reductions, and TrustZone Media Protection (TZMP) bypasses
Sorona
-
Software and devices that no longer receive security updates, attacks needing physical access, a man in the middle or a compromised account, and spam, social engineering, DDoS or brute force
Sorona
-
The Linux kernel itself, non-Mali modules, other Mali drivers such as Lima, Panfrost and Panthor, the patches that let Kbase run on a virtual device, and a vendor's platform-specific code, which Arm asks you to take to the OEM
Sorona
-
Undefined-behaviour reports without a demonstrated exploitable impact, and out-of-date-software claims with no proof of concept. Arm invites these anyway, along with Kbase crashes and WARN traces, for a small discretionary bonus rather than a tier payment
Sorona
Recent changes
Reward and scope changes across every Arm program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under arm.com and the companies Arm owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Arm.
Something wrong or missing? Report a correction.