Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Linux Kernel Security

By The Linux Kernel Vulnerability disclosure program on Self-hosted kernel.org

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
2
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report as the policy says
The policy page explains how.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Scope

2 assets you may test.

Domains 1

  • kernel.org

Source code 1

  • Linux kernel

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Linux Kernel Security's policy.

While testing

  • Do not send it to a public list at this stage, unless you have good reasons to consider the issue as being public or trivial to discover
  • Please send plain text emails without attachments where possible.
  • Markdown, HTML and RST formatted reports are particularly frowned upon
  • Binary-only executables are not accepted.
  • do not publicly share a reproducer, as this could cause unintended harm; just mention that one is available
  • The report must be sent to maintainers.
  • If there are two or fewer recipients in your message, you must also always Cc: the Linux kernel security team
  • the kernel security team strongly recommends that as a reporter of a potential security issue you DO NOT contact the “linux-distros” mailing list UNTIL a fix is accepted
  • Before contacting the security team, the reporter must ensure they are available to explain their findings, engage in discussions, and run additional tests.

Not accepted

  • bugs that have been improperly qualified as security bugs due to a lack of awareness of the Linux kernel’s threat model
  • regular bugs that have been improperly qualified as security bugs

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.