Kernel-level anti-cheat isn’t new; it’s been around for quite some time. While earlier iterations mostly relied on server-side detection, modern versions run in Ring 0 of the operating system, which means they have access to nearly everything.

Handing a program Ring 0 access is a massive security red flag and far from something that should be normalized.

Unfortunately, most live-service games use this solution extensively, and it’s just something that doesn’t sit right with me. Not to mention, it also gates Linux users.

Kernel-level anti-cheat carries massive security risks

You’re relying on the goodwill of these companies to not have anything happen to you

To understand how kernel-level anti-cheat works, we first need to know what it does. Essentially, it is a program (or driver) that runs in the OS kernel space (Ring 0) and looks for anomalies that could be triggered by using a cheat.

These kinds of anti-cheat software work by routinely checking game memory integrity and for system hooks and calls that might transfer “faked” data. In other words, it actively scans your system for what it deems “dangerous” software and loads with Windows during the boot process.

Kernel drivers also have the risk of carrying unmitigated access to the host system’s memory and hardware — meaning there is quite literally nothing stopping the program from reading your browser sessions, password managers, and so on.

That’s not to say that kernel-level anti-cheat does these kinds of things actively. It’s just that you’re relying on the goodwill of these companies to not have it happen in the first place. To add to that, there have been numerous security lapses that have made use of loopholes to gain Ring 0 access to a PC, which sounds just as bad as you’d think.

There have been multiple security lapses in the past

Unprivileged access results in vulnerabilities, to no one’s surprise

There have been at least two separate reports of kernel-level anti-cheat causing mayhem in some form or another between 2024 and 2026. The first of which is “CVE-2021-47739”, triggered by a vulnerability in EAC 4.0 (Easy Anti-Cheat). This particular incident allowed local, unprivileged users to access the LocalSystem and potentially inject malicious code.

Worse, this was reportedly discovered in 2021 but didn’t receive an official CVE identifier until years later.

The second incident involves Hoyoverse’s Genshin Impact, which installs a custom anti-cheat driver known as mhyprot2.sys, which ransomware hijacked to remotely disable antivirus at the kernel level.

That’s not taking into account the dozens of BYOVD attacks and Rootkit opportunities that something like Vanguard would present. I would not consider kernel-level anti-cheat “safe” in any sense of the term, and would very much like to keep it out of my installations. It’s not like it deters cheats either.

Additionally, a poorly coded kernel-level driver can cause havoc, often resulting in BSODs, system hangs, and, at worst, boot failures.

Kernel-level anti-cheat also restricts access to the game

TPM 2.0 and Secure Boot feel unnecessary

By far the biggest hurdle presented by modern kernel-level anti-cheat software is strict system requirements. Any modern live service game will usually mandate that both Secure Boot and TPM be made available on the system, even if it doesn’t amount to much. Without these two hardware layers, games would outright refuse to work — effectively gatekeeping a fair number of perfectly usable PCs, just because they do not meet some unnecessarily enforced hardware requirement.

That’s not talking about alternative operating systems, either. Ring 0 access is not handed out in the same way for games under Linux when compared to Windows 11, which makes these titles entirely incompatible for those on the Penguin.

Given how popular desktop Linux has gotten in the past few years, this seems like a massive step backward.

Thankfully, some anti-cheat solutions do work just fine under Linux, even if many of these titles like to restrict themselves to certain hardware (like with Delta Force on the Steam Deck) for some odd reason.

It’s a never-ending cat-and-mouse game

I wish I could say that kernel-level anti-cheat, despite its many flaws, is effective, but the truth is far from it. It’s a well-known fact that dealing with hackers and exploits within games is something of a cat-and-mouse game.

It doesn’t take very long for malicious actors to reverse engineer and/or find a backdoor that makes their exploits work again, and game devs have been consistently on the clock, patching vulnerabilities and such to mitigate the same.

No solution is truly permanent in the long run, and the best way to go about it is by actively revoking access to nefarious users and consistently updating the software kit. In many ways, fighting off cheaters is an uphill battle, and kernel-level solutions cause more harm than good, if you ask me.

It’s an incredibly invasive piece of software that has no business staying on your PC, and normalizing it is something I’ve come to detest. Especially with their strict hardware requirements, which prevent a lot of users from running them in the first place.

Until then, anything that isn’t kernel-level is fine in my book, and there have been plenty of examples in recent years, like Arc Raiders and the slew of anime-styled F2P games on Steam.