Kernel-Level Anti-Cheat: Inside Gaming’s Most Invasive Arms Race

ByMarcus Vale

What Ring 0 Access Actually Means

Operating systems divide access into privilege levels called rings. User applications — browsers, game clients, media players — run at ring 3. The OS kernel runs at ring 0, with unrestricted access to memory, hardware, and every running process on the machine. Anti-cheat software that operates at the kernel level runs at ring 0. Same depth as the OS itself.

The reason publishers went this far is straightforward: cheats that hook into game memory at ring 0 are invisible to anything running at ring 3. To detect them, you have to operate at the same level. That logic is not wrong. It is just uncomfortable when you examine the implications.

Boot-Time vs. Load-on-Launch: The Distinction Most Players Miss

Not all kernel anti-cheat systems work the same way, and the difference matters when you are actually assessing what is installed on your machine.

Riot’s Vanguard and FACEIT Anti-Cheat load a kernel driver at system boot. The driver is running whether you play a game that day or not. This gives them early visibility into system state before any cheat could load — but it means there is a kernel-level component sitting in memory from the moment Windows starts.

EasyAntiCheat and BattlEye take the load-on-launch approach. Their kernel components start when you open the game and stop when you close it. A vulnerability in the driver can only be exploited during a gaming session, not at any point the machine is on.

When players say anti-cheat is “running in the background” or “turning on with your PC,” they are usually describing Vanguard specifically. Grouping all kernel anti-cheat under that description is imprecise — and it matters when the conversation turns to actual security risk.

The 2024 Paper That Put Numbers to the Concern

At ARES 2024, the International Conference on Availability, Reliability and Security, researchers published “If It Looks Like a Rootkit and Deceives Like a Rootkit: A Critical Examination of Kernel-Level Anti-Cheat Systems.” It evaluated BattlEye, EasyAntiCheat, FACEIT, and Vanguard against a formal rootkit taxonomy — the same framework used to classify actual malware.

The findings were specific. FACEIT and Vanguard both scored high on evasion, virtualisation detection, early boot execution, broad information exfiltration, and — critically — limited removability. BattlEye and EAC fared better on several metrics, largely because of their load-on-launch design.

The researchers were careful to separate intent from technical function. These are not malicious programmes, and the paper said so explicitly. But the technical fingerprint is close enough that endpoint security tools regularly flag them. Same kernel callbacks. Same OS hooks. Same depth. The paper’s broader point was that consumers are routinely asked to install software that would fail any enterprise security audit, without fully understanding what they are accepting.

The paper was published through the ACM Digital Library and is also available as a preprint on arXiv. It is worth reading in full if you want the scoring methodology rather than the summary.

Linux Gets Locked Out

VALORANT does not run on Linux. Neither does Call of Duty. Riot’s stated reason is blunt: the Linux kernel can be modified freely, with no attestation mechanism that ties hardware to OS to application in a trusted chain. Their stated concern was that a purpose-built cheating Linux distribution would be straightforward to produce. Activision has added TPM 2.0 and Secure Boot requirements to recent Call of Duty entries for similar reasons.

This has become a significant problem for Valve. SteamOS, the Linux-based OS running on the Steam Deck, runs Windows games through a compatibility layer. Most kernel anti-cheat systems need to load kernel-level drivers, and they do not ship Linux kernel modules. Games that require kernel anti-cheat simply do not launch.

The pool of affected titles is substantial. VALORANT, all recent Call of Duty entries, and a growing list of titles using EA’s Javelin system are all off the table on Linux. Players who chose Linux for privacy reasons — the same people most likely to object to kernel-level software in the first place — get hit hardest.

When Betting Markets Get Involved

Counter-Strike 2 accounted for 57% of the global esports betting handle in the first half of 2025. The broader esports betting market reached roughly $2.8 billion for the year. At that scale, match integrity stops being a sporting ethics question and becomes a financial systems question.

Stat-based prop bets are the sharper edge of the problem. An aimbot that adds a handful of kills per map is probably not going to change who wins. But it will move a first-blood market, a kills-per-round line, or a headshot-percentage prop. Detection at the bookmaker side is mostly retrospective — the anomaly gets flagged after the match ends and after the money has already settled.

CS2’s professional scene runs under FACEIT’s kernel system. VALORANT’s runs under Vanguard. Both are among the systems the 2024 ARES paper identified as exhibiting the most rootkit-like behaviour. The competitive environments with the largest financial stakes are running the most technically aggressive anti-cheat. That is not a coincidence — it reflects the genuine technical requirement of operating at the level of the threat.

The Player Backlash Playbook

Helldivers 2 launched in early 2024 to strong sales and almost immediate controversy. nProtect GameGuard, the kernel-level system developed by INCA Internet, drew criticism over crashes, stutters, and extended load times — particularly on AMD hardware. The game’s Technical Director, Peter Lindgren, responded in a detailed Reddit post defending the software and clarifying that it ran only while the game was active. Players pushed back specifically on uninstallation claims. The controversy ran for weeks.

Vanguard’s April 2024 rollout in League of Legends followed the same script. Reports of bricked PCs, kernel panics, forum threads with thousands of comments. Riot’s Head of Anti-Cheat published a retrospective in August 2024 that was notably transparent by industry standards — addressing the main technical concerns directly rather than dismissing them. The criticism did not stop.

The pattern is predictable enough to write out in advance. Game adds kernel anti-cheat. Community discovers it. Backlash peaks over a few weeks. Developer publishes a response. Most players move on. The software stays. Publishers have largely concluded that the backlash cost is lower than the ongoing cheating cost.

What Kernel Anti-Cheat Cannot Stop

Hardware-based cheats using Direct Memory Access cards operate outside the reach of any software anti-cheat. A DMA card connects directly to the PCIe bus and reads game memory from a separate device — often a small single-board computer — that the game PC’s OS never sees. The kernel driver on the game machine has nothing to detect because the cheat is not running on the game machine.

High-end private cheat subscriptions have moved almost entirely to this model. It is expensive and technically demanding, which has pushed it out of casual play. That is a real win — public cheating in casual lobbies has decreased substantially since kernel anti-cheat became standard. The average player’s experience is genuinely better.

But the top tier of the cheat development industry adapted and moved the problem into hardware. What kernel anti-cheat has mostly achieved is making casual cheating significantly harder while pushing serious cheating out of software and into a space where software cannot follow. Whether that counts as winning depends on which problem you were trying to solve.

Sources


Similar Posts