Google’s kvmCTF lists a top reward of $250,000 for a demonstrated full virtual-machine escape from the upstream Linux Kernel-based Virtual Machine (KVM). It is a tiered vulnerability reward program—not a guaranteed payment for entering—and submissions must prove the claimed impact and include the corresponding flag. Rewards do not stack.
What is Google’s kvmCTF?
kvmCTF is Google’s vulnerability reward program for bugs reachable from a virtual machine that could enable an attack against the host’s KVM virtualization layer. Google introduced the program in June 2024 to let researchers demonstrate their “bug hunting and exploitation techniques.” Its rules also encourage publication of submissions so the wider security community can learn from them. Google’s announcement and the official kvmCTF rules describe the program.
How much does Google pay for a KVM VM escape?
The official rules list $250,000 for a full VM escape. That is the highest listed tier, payable only when the submission demonstrates that impact and satisfies the program’s requirements. The rules page does not date its reward table, so these amounts should be checked against the official rules before relying on them.
| Demonstrated impact | Listed reward |
|---|---|
| Full VM escape | $250,000 |
| Arbitrary memory write | $100,000 |
| Arbitrary memory read | $50,000 |
| Relative memory write | $50,000 |
| Denial of service | $20,000 |
| Relative memory read | $10,000 |
Do kvmCTF rewards stack?
No. Google awards the highest tier demonstrated; it does not add the values of separate impacts together. The rules give the example of a full VM escape that also uses arbitrary memory read: it qualifies for the $250,000 full-escape tier, not $250,000 plus $50,000.
#1 Best Overall
- 【Dual-Band Wi-Fi 6 Desktop KVM Device】Comet Pro supports both 2.4 GHz and 5 GHz Wi-Fi bands for a cleaner setup with less cabling. By providing both wired and wireless connectivity, it eliminates single points of failure and redefines flexibility for remote access.
- 【4K Video Passthrough & Two-Way Audio】The GL-RM10 features 4K@30FPS video passthrough and two-way audio, delivering ultra-clear, low-latency streams via H.264 encoding without interrupting the local display. Its audio support ensures crystal-clear voice interaction —ideal for remote meetings and IT support to create a natural "face-to-face" experience.
- 【Touchscreen Interface】The 2.22-inch built-in touchscreen features an intuitive user interface that is easy to operate and requires no technical expertise, allowing you to effortlessly view and manage important functions—such as connecting to Wi-Fi networks and enabling or disabling cloud services.
- 【Built-in Tailscale】 Enables secure, efficient data transfer between devices using WireGuard's encrypted transmission and direct connection features. Ideal for home labs, offices, and multiple networking scenarios.
- 【Flexible Remote Access】Remote access can be achieved through our web based cloud control functionality, supporting Windows, macOS, and Linux systems without needing to install any software. Additionally, there is remote support via the GLKVM app available to Windows, macOS, iOS and Android devices.
What bugs qualify for Google’s KVM bounty?
The rules target vulnerabilities reachable from a guest that reproduce on upstream Linux mainline master and affect KVM. The contest environment is a specified setup for testing; matching that setup alone is not enough if the bug exists only in a downstream backport or an older LTS tree.
Specified test environment
- Host: Linux v6.1.74 on an Intel Xeon Gold 5222. Participants may choose whether the host runs with CONFIG_KASAN enabled.
- Guest: Debian 12.5 (bookworm), running kernel v6.1.0-21.
- Objective: demonstrate a successful guest-to-host attack.
- Reproduction requirement: eligible vulnerabilities must also reproduce on upstream Linux mainline master.
Google’s test setup download includes its kernel patch, configuration files, compiler and binutils versions, virsh version, kernel and module binaries, and the qemu-kvm command. Consult the rules and test setup for the exact artifacts and current requirements.
Rank #2
- 【Effortless Remote Device Control】 Remotely reboot, install operating systems via BIOS interface, and power on computers – all without ever setting foot in the data center. Ideal for IT professionals and smart home users alike. (Note: PD adapters cannot be used.)
- 【Universal Compatibility & Easy Setup】 Seamlessly connect to laptops, desktops, servers, and more. Simple one-click connection via app – the computer being controlled requires no additional software.
- 【Crystal-Clear Remote Experience】 Enjoy desktop-quality visuals (3840x2160@30Hz resolution, low latency) Remote audio output for immersive and complete remote control.
- 【Instant File Transfer】 Transfer files between computers effortlessly. No more tedious synchronization issues when working remotely.
- 【Access Anytime Anywhere】 Maintain constant remote access to your computers, boosting productivity whether you're at home or on the go. Perfect for remote work and managing multiple computers.
Explicit exclusions
The rules exclude QEMU vulnerabilities, host-to-KVM attacks, and CPU-, DRAM-, or other hardware-based vulnerabilities from rewards. Although QEMU is part of the virtualization stack and appears in the test setup, the program’s stated target is KVM; a bug in an excluded component does not become eligible simply because it is found while testing the environment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What proof does a submission need?
A participant must demonstrate the impact claimed for the tier and provide the associated 64-bit flag. A flag by itself does not prove eligibility: the exploit must actually achieve the stated result. For the RCE flag, the rules specify reading /root/rce_flag on the host; they also define proof flags for arbitrary memory-access outcomes. The precise validation and submission requirements are in the official rules.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Best Value
- Power over Ethernet (PoE): Comet PoE (GL-RM1PE) enables easy device powering with PoE support. Users can simply connect it to a PoE switch to eliminate extra power adapters and reduce cable clutter
- Built-in Tailscale: Enables secure, efficient data transfer between devices using WireGuard's encrypted transmission and direct connection features for home labs, offices, and multiple networking scenarios
- Dual Power Option (PoE & Type-C): Supports 5V power adapters, both PoE and the adapter can be used simultaneously for enhanced power stability
- Built-in 32GB eMMC Storage: The Comet PoE (GL-RM1PE) comes with built-in 32GB eMMC storage, pre-loaded with multiple system images for quick and reliable device restoration or updates. This simplifies system management and future-proofs your network
- 4K@30Hz HD Video & Ultra-Low Latency: Experience ultra-clear, low-latency 4K video streaming with efficient H.264 hardware encoding. Combined with built-in two-way audio, it enables seamless audio conferencing, real-time troubleshooting, and remote monitoring for professional communications and management
Rank #4
- MT-VIKI 1568UL is our latest all-in-one console to manage up to 8 computers. Features a 15.6" LCD monitor with 1920x1080@60Hz resolution. Combines monitor, keyboard, and touchpad into a single 1U rackmount drawer to save up to 85% of valuable cabinet space. Built-in USB 2.0 in front panel for external mice or keyboard.
- Adjustable Depth & 2 Set Rack Rails: Includes two sets of Rack Rails. Short Rack Rails: Fit 18.9"–23.6" (480-600mm) deep network racks (Note: check cable clearance for depths under 600mm). Long Rack Rails: Fit 23.6"–31.5" (600-800mm) deep standard racks. Measure your rack depth before purchase to ensure a perfect fit.
- External Monitor Support & Flexible Operation--Features an VGA console output for connecting an external monitor, allowing convenient server access without opening the rack. Supports front panel buttons, touchpad, hotkeys, and OSD menu control. Support password prodected: provides 2-level password security (administrator and user), up to 8 authorized users and an administrator view and control the computers.
- ALL-IN-ONE Design, Lightweight Aluminum & Steel Build: Upgraded with an aluminum interior for less weight and a rugged steel drawer shell for industrial durability. Easy to install. Features a built-in handle and lock for secure operation. Physical Dimensions: 18.9" x 23.6" x 1.77" (480mm x 600mm x 45mm).
- Built for Professional Environments – Ideal for server rooms, data centers, industrial control systems, and security monitoring centers where multiple computers need centralized management or when technicians need direct access to connected systems without an external monitor.
Rank #3
- MT-VIKI 801UK-L, this 8 port KVM switch allows 1 set of USB 2.0 Keyboard & Mouse & monitor to control 8 computers.
- 2 switching options: 1: desktop switch: with 2M wire-extended selector, 2: button switching: press the button to select the PC
- Wide Support: This rack mount kvm switch vga supports WIN DOWS9X, NT, WIN2000, WINXP, WIN7, LINUX, NOVELL and other operating systems.
- Safety: Easy to install, connect and use, USB 2.0 port, high quality, and durable cable. Plug and play, no power supply required. Plug USB + VGA head cable into your computer to gain power .
- If need 16 ports vga kvm switch pls search ASIN: B08ZMPSQBM. The USB VGA KVM cable included 4pcs 5ft/1.5m & 4pcs 6ft/1.8m, if require 10ft/16ft, please order ASIN: B08ZJ41YD4.
What to check before participating
- Confirm the issue is reachable from the guest and targets KVM rather than an excluded component.
- Check that the vulnerability reproduces on upstream Linux mainline master, not only on the contest’s LTS setup or a downstream backport.
- Demonstrate the specific impact claimed for the reward tier and obtain the corresponding proof flag.
- Review the current rules for eligibility, submission procedure, and any changes to the environment or rewards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
