Google now pays $250,000 for KVM zero-day vulnerabilities

Google launched kvmCTF, a new vulnerability reward program targeting zero-day, guest-to-host exploits in the KVM hypervisor, offering rewards up to $250,000 for full VM escapes. The program provides a controlled lab environment for researchers to capture flags, focuses strictly on VM-reachable KVM bugs (excluding QEMU/host-to-KVM issues), and maps KASAN violations to reward tiers. Vulnerability details are shared with Google only after upstream patches are released, and participants must follow published rules for reservations, exploitation, and reporting.