kernelCTF (Linux kernel LTS)

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Maximum for a single submission (base + stability + 0-day) │ $101,337 │ $102,337 Base reward, working exploit against the latest LTS instance │ $71,337 │ $72,337 0-day bonus (non-patched, non-disclosed vulnerability) │ $20,000 │ $21,000 Stability bonus (exploit_repro reports 90% reliability or better) │ $10,000 │ $11,000 Novel exploitation techniques, judged quarterly at Google's discretion │ up to $20,000 │ up to $21,000 Submit a vulnerability CVE history 5,198 Last 12 months 18,708 Lifetime Memory safety 45 % Denial of service 25 % Access control 12 % Info disclosure 10 % Latest advisories Loading the feed Overview kernelCTF is Google's standing exploit contest against the upstream Linux LTS kernel, and the target is the real thing: a live instance running the latest LTS with the Container-Optimized OS kernel config, not a Google product with a Linux flavour. The Linux kernel is the highest-blast-radius codebase in open source, it runs the majority of public cloud instances, every Android handset, ChromeOS, essentially all container hosts, most network appliances and the overwhelming majority of embedded and automotive Linux, so a single privilege escalation in a common LTS subsystem is simultaneously a container escape, an Android root and a shared-hosting takeover. What makes this program unusual is that it does not pay for a report at all: it pays for a working exploit that steals the flag from Google's instance. The base reward is $71,337, a stability bonus of $10,000 applies when exploit_repro measures reliability at 90% or better, a 0-day bonus of $20,000 applies to a vulnerability that is neither patched nor disclosed, and a single submission tops out at $101,337; novel exploitation techniques are judged separately each quarter for up to $20,000 more. The instance is deliberately hardened against the surfaces that were producing too many winners: unprivileged user namespaces have been off since July 2025, and io_uring and nftables are disabled too. Google Patch Rewards pays $15,000 for a merged upstream kernel patch, but that is a separate pathway for a different piece of work. sorona.xyz adds 1.25× on top of whatever the contest awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The contest declares one target: a live instance running the latest LTS Linux kernel with the Container-Optimized OS config. The code under test is the upstream GPL-2.0 kernel rather than a Google fork, and what pays is a working exploit that takes the flag off that instance Any subsystem the Container-Optimized OS config compiles in and an unprivileged local user can reach: the syscall entry paths, the VFS and the filesystems built into that config, memory management, the scheduler, futexes and System V IPC, cgroups, eBPF, perf and tracing, the /proc and /sys interfaces, and the character and block devices exposed under /dev The networking stack as configured, covering the socket layer, protocol handling and netlink Local privilege escalation from an unprivileged user to root, demonstrated end to end by stealing the flag off the instance Both 0-day and 1-day vulnerabilities: a bug already patched upstream still earns the base reward, it just does not carry the $20,000 0-day bonus The reliability of the exploit itself, which is scored rather than assumed: exploit_repro has to report 90% or better before the stability bonus applies Novel exploitation techniques against any available environment, judged quarterly at Google's discretion and paid separately from the exploit ladder Out of scope Anything that depends on unprivileged user namespaces, disabled on the instance since 1 July 2025 precisely because that surface was producing too many winning exploits io_uring and nftables, both disabled on the target for the same reason Duplicates and late entries: "Only the first submission for a vulnerability is eligible for a reward (per target)", and there is one paid slot per LTS kernel version Submissions that require a separately supplied KASLR base, which the 2026-04-30 rules removed as an option Anything short of a demonstrated, working exploit. A crash, a theoretical write primitive or a patch on its own does not qualify Kernel versions other than the LTS the instance is currently running, which rotates every two to four weeks on average Most-valued findings A reliable unprivileged-to-root escalation on the live instance that reaches its primitives without namespaces, io_uring or nftables. Those three are off and everything else in the kernel is still fair game. This is the $71,337 base and, with both bonuses, the full $101,337 The same exploit built on a vulnerability that is neither patched nor publicly disclosed, worth $20,000 on its own and the reason the routing clause matters before you tell anyone else An exploit that survives being run repeatedly rather than working once on a lucky heap layout: 90% measured reliability is a $10,000 line item, so hardening the spray and the race window is paid work Memory-safety primitives in subsystems an ordinary user can still reach after the hardening. That is the 45% class here, and the only realistic route to a flag steal A novel exploitation technique that generalises past one bug, judged quarterly for up to $20,000 whether or not it wins a slot on the main ladder Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A working exploit against Google's live instance is required; a vulnerability report on its own earns nothing here One paid slot per LTS kernel version, first submission only: only the first submission for a given vulnerability is eligible per target Report the vulnerability to [email protected] within 7 days of submitting, and publish the exploit within 90 days The instance runs with unprivileged user namespaces, io_uring and nftables disabled, so an exploit that needs any of the three will not run at all Submissions that require a separately supplied KASLR base are ineligible; the rules re-issued on 2026-04-30 removed that option The $20,000 0-day bonus is lost if the vulnerability details were reported anywhere other than [email protected] , which includes other contests and platforms Disclosure kernelCTF is a publish-everything program on a fixed clock: the vulnerability goes to [email protected] within 7 days and the exploit itself is published within 90. Because the 0-day bonus turns explicitly on where the details were reported, send them to [email protected] first and route the write-up to sorona.xyz afterwards; we hold your finding until the kernel security team has the fix out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability