# Kernel-level anti-cheat
A kernel-level anti-cheat is game-security software that runs as a signed driver inside the operating system kernel (Ring 0 on x86 systems), at the same privilege level as the OS itself, so it can read physical memory, enumerate every process and loaded driver, and intercept low-level system calls that user-mode software cannot reach.[1](https://burgercheats.com/blog/kernel-level-anti-cheat/) Publishers adopted the approach because cheats had moved into the kernel themselves: a cheat driver can intercept any request a user-mode anti-cheat makes to the kernel, completely blinding it.[2](https://www.riotgames.com/en/news/vanguard-on-demand)
| Key fact | Detail |
|---|---|
| Privilege level | Runs as a signed kernel-mode driver in Ring 0, sharing the operating system's own privilege level[1](https://burgercheats.com/blog/kernel-level-anti-cheat/) |
| Rationale | User-mode anti-cheat is compromised by any cheat running at a higher privilege level; kernel cheats can masquerade as "clean" to any user-mode process[3](https://www.riotgames.com/en/news/a-message-about-vanguard-from-our-security-privacy-teams) • [2](https://www.riotgames.com/en/news/vanguard-on-demand) |
| Major systems | Riot Vanguard (VALORANT, League of Legends), Easy Anti-Cheat (Epic Games, over 150 games), BattlEye (first released 2004), FACEIT Anti-Cheat, EA Javelin Anticheat[4](https://people.cs.rutgers.edu/pxk/classes/419/notes/malware-7-anti-cheat.html) • [5](https://tomchothia.gitlab.io/Papers/AntiCheat2024.pdf) • [6](https://www.ea.com/news/ea-javelin-anticheat-2026-update) |
| Rootkit comparison | A 2024 academic analysis of four widespread kernel anti-cheats found two, FACEIT Anti-Cheat and Vanguard, exhibiting rootkit-like behavior[7](https://arxiv.org/abs/2408.00500) |
| Linux support | Kernel-space anti-cheat is not supported on Proton/SteamOS; EAC and BattlEye can run in user space on Linux when developers enable it[8](https://partner.steamgames.com/doc/steamhardware/proton) |
| Scale example | EA Javelin Anticheat (launched September 2022) reported 20 protected titles, 57.1 million players safeguarded, and 26.7 million cheat attempts prevented in one year[6](https://www.ea.com/news/ea-javelin-anticheat-2026-update) |
## Why the kernel
The move to Ring 0 followed the cheats. In the mid-2000s, anti-cheat clients such as PunkBuster and [Valve Anti-Cheat](https://www.edgepedia.org/valve-anti-cheat) performed user-mode signature scanning of process memory.[9](https://zebonastic.substack.com/p/why-anti-cheat-software-is-so-complex) [Paul Chamberlain](https://www.edgepedia.org/paul-chamberlain), a security engineer who has worked on anti-cheat for VALORANT, Fortnite, and [League of Legends](https://www.edgepedia.org/league-of-legends), estimated that around 2008 only about 5 percent of sophisticated cheat developers used kernel drivers, but by about 2015 essentially all organized cheat-selling operations did.[10](https://www.wired.com/story/kernel-anti-cheat-online-gaming-vulnerabilities/) At a Steam developer conference around that time, Aarni Rautava, an engineer at Easy Anti-Cheat, put the cheat marketplace at somewhere north of $100 million.[10](https://www.wired.com/story/kernel-anti-cheat-online-gaming-vulnerabilities/)
**The privilege argument.** If anti-cheat runs only in user mode, its capabilities are compromised by a cheat running at a higher privilege level; Riot has cited advanced cheating communities using Direct Memory Access (DMA) hardware to rebroadcast memory to a separate computer for processing.[3](https://www.riotgames.com/en/news/a-message-about-vanguard-from-our-security-privacy-teams) Kernel-mode cheating exploits vulnerabilities to load cheat components into the operating system itself, hooking memory-management functions so the cheat bypasses process protections and appears clean to any user-mode application.[2](https://www.riotgames.com/en/news/vanguard-on-demand) EA states the same position: the last few years have seen a large increase in kernel-mode cheats, so the only reliable way to detect and block them is for the anti-cheat to operate there as well.[11](https://www.ea.com/games/battlefield/news/eaac-and-battlefield)
## How the systems work
A typical deployment installs a signed kernel driver alongside the game.[4](https://people.cs.rutgers.edu/pxk/classes/419/notes/malware-7-anti-cheat.html) The CheckMATE 2024 classification of anti-cheat techniques groups kernel-level protections into detecting Windows test-signing mode, verifying drivers against lists of known-vulnerable signed drivers, detecting driver injection, and scanning kernel memory for executable code not backed by any properly loaded module.[5](https://tomchothia.gitlab.io/Papers/AntiCheat2024.pdf) The same survey distinguishes three invasiveness tiers: user-space anti-cheat (for example Valve Anti-Cheat in [Counter-Strike 2](https://www.edgepedia.org/counter-strike-2)), kernel-level anti-cheat loaded with the game (Easy Anti-Cheat and BattlEye, which Fortnite runs together), and the most invasive tier, kernel-level anti-cheat loaded at system boot and running constantly; at the time of writing only VALORANT with Riot Vanguard used that tier.[5](https://tomchothia.gitlab.io/Papers/AntiCheat2024.pdf)
**Vanguard's architecture** consists of three components: a user-mode client that handles detections while a game runs, a kernel-mode driver that validates memory and system state and runs at startup to prevent cheats loading before the client initializes, and a platform service. Riot states the driver does not collect or send information about the computer back to the company.[3](https://www.riotgames.com/en/news/a-message-about-vanguard-from-our-security-privacy-teams) EA Javelin, by contrast, runs only while a protected game is running and uninstalls itself once all protected EA games are removed.[6](https://www.ea.com/news/ea-javelin-anticheat-2026-update)
## Security and privacy criticism
Because a kernel driver shares the trust model of security-critical software, any vulnerability in it is a local privilege escalation to Ring 0.[12](https://s4dbrd.github.io/posts/how-kernel-anti-cheats-work/) The risk is not hypothetical: in 2016 Capcom shipped a kernel driver with the PC version of [Street Fighter V](https://www.edgepedia.org/street-fighter-v) that let anyone load kernel code arbitrarily, bypassing Windows signature checks, and Capcom reverted it shortly after security researchers disclosed the flaw.[10](https://www.wired.com/story/kernel-anti-cheat-online-gaming-vulnerabilities/) A fatal error in a kernel driver can also crash the entire system rather than just the application, because no backup measures protect vital Windows processes from a faulty driver.[13](https://research-archive.org/index.php/rars/preprint/download/657/1032/815)
A 2024 study by Christoph Dorner and Lukas Daniel Klausner, presented at the ARES 2024 conference in Vienna, applied rootkit-characterization metrics to four widespread kernel anti-cheat systems (BattlEye, Easy Anti-Cheat, FACEIT Anti-Cheat, and Vanguard) and found FACEIT Anti-Cheat and Vanguard exhibiting rootkit-like behavior that threatens privacy and system integrity.[7](https://arxiv.org/abs/2408.00500) Penetration-testing firm founder Adriel Desautels has countered that a remotely exploitable anti-cheat driver attack would cost hundreds of thousands of dollars or more to develop, and that attackers generally pursue easier, higher-value targets.[10](https://www.wired.com/story/kernel-anti-cheat-online-gaming-vulnerabilities/)
## The platform context
Microsoft has been tightening the kernel itself. Since the [Windows 11](https://www.edgepedia.org/windows-11) 2022 update, the vulnerable driver blocklist is enabled by default and is enforced whenever memory integrity (HVCI), Smart App Control, or S mode is active; the blocklist is updated quarterly.[14](https://learn.microsoft.com/en/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules) The April 2026 Windows security updates removed default trust for drivers signed under the deprecated cross-signed program, and the Windows Driver policy now restricts loading to WHCP-certified drivers plus an allow list.[15](https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing-windows-driver-security-removing-trust-for-the-cross-signed-driver-pro/4504818) • [16](https://support.microsoft.com/en-us/windows/hardware/drivers/the-windows-driver-policy) These changes squeeze the same abused-driver pathways that cheat developers exploit, which anti-cheats counter by blocking known-vulnerable drivers from loading.[5](https://tomchothia.gitlab.io/Papers/AntiCheat2024.pdf)
**Linux and handhelds.** Kernel-space anti-cheat is not supported on [Proton](https://www.edgepedia.org/proton-software) and is not recommended by Valve; user-space components are recommended instead.[8](https://partner.steamgames.com/doc/steamhardware/proton) Easy Anti-Cheat and BattlEye have Proton compatibility that runs outside the kernel, but each developer must enable it per title.[8](https://partner.steamgames.com/doc/steamhardware/proton) A kernel driver is structurally difficult on Linux: the kernel is user-modifiable and GPL-licensed, and while Linux does not guarantee a stable internal kernel interface, this does not make proprietary kernel modules architecturally incompatible with its security model.[17](https://arxiv.org/abs/2609.20909)
## Alternatives under research
Research prototypes aim to keep anti-cheat strength without an untrusted kernel component. Tirith, from [Microsoft Research](https://www.edgepedia.org/microsoft-research) and collaborators, runs games inside Protected Virtual Machines sandboxed from untrusted administrators and uses a virtualization monitor trusted by both players and developers, claiming equivalent protection against a wide range of common cheating mechanisms; its graphics pipeline adds at most 0.14 ms of latency over native execution in the authors' benchmarks.[18](https://arxiv.org/abs/2609.17525) TPM-Attest proposes hardware-rooted remote attestation using TPM 2.0 and the Linux Integrity Measurement Architecture to prove a client booted cleanly, with no kernel driver and no memory scanning.[17](https://arxiv.org/abs/2609.20909) Server-side approaches, including mirroring game rules on servers and statistical analysis of player events, have been proposed as less intrusive options.[19](https://www.inf.ufpr.br/vinicius/files/ISCC-2025.pdf) Publishers continue to layer other defenses on top of drivers: EA Javelin added anti-DMA protection and input-manipulation defenses, and its [Secure Boot](https://www.edgepedia.org/secure-boot) requirement led over 4.8 million players to enable Secure Boot.[6](https://www.ea.com/news/ea-javelin-anticheat-2026-update)
## References
1. [Kernel-Level Anti-Cheat: How It Works & Is It Safe? (Burgercheats)](https://burgercheats.com/blog/kernel-level-anti-cheat/)
2. [Vanguard On-Demand – Anti-Cheat Update (Riot Games)](https://www.riotgames.com/en/news/vanguard-on-demand)
3. [A Message About Vanguard From Our Security & Privacy Teams (Riot Games)](https://www.riotgames.com/en/news/a-message-about-vanguard-from-our-security-privacy-teams)
4. [Addendum: Kernel Anti-Cheats (Rutgers CS 419 course notes)](https://people.cs.rutgers.edu/pxk/classes/419/notes/malware-7-anti-cheat.html)
5. [Collins, Poulopoulos, Muench, Chothia (2024). Anti-Cheat: Attacks and the Effectiveness of Client-Side Defences. CheckMATE '24.](https://tomchothia.gitlab.io/Papers/AntiCheat2024.pdf)
6. [Raising the Bar: A Year of Progress for EA Javelin Anticheat (EA, September 2026)](https://www.ea.com/news/ea-javelin-anticheat-2026-update)
7. [Dorner, C., Klausner, L. D. (2024). If It Looks Like a Rootkit and Deceives Like a Rootkit: A Critical Examination of Kernel-Level Anti-Cheat Systems. ARES 2024.](https://arxiv.org/abs/2408.00500)
8. [Steam Hardware and Proton (Steamworks Documentation, Valve)](https://partner.steamgames.com/doc/steamhardware/proton)
9. [Why anti-cheat software is so complex (Zebonastic Substack)](https://zebonastic.substack.com/p/why-anti-cheat-software-is-so-complex)
10. [What's the Deal With Anti-Cheat Software in Online Games? (WIRED, January 2022)](https://www.wired.com/story/kernel-anti-cheat-online-gaming-vulnerabilities/)
11. [EA anticheat and Battlefield (EA)](https://www.ea.com/games/battlefield/news/eaac-and-battlefield)
12. [How Kernel Anti-Cheats Work: A Deep Dive into Modern Game Protection (Adrian's Security Research)](https://s4dbrd.github.io/posts/how-kernel-anti-cheats-work/)
13. [Fortifying Game Security: Unveiling Vulnerabilities in Valve Anti Cheat and a Novel User Mode Anti-Cheat Solution (Research Archive of Rising Scholars)](https://research-archive.org/index.php/rars/preprint/download/657/1032/815)
14. [Microsoft recommended driver block rules (Microsoft Learn)](https://learn.microsoft.com/en/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules)
15. [Advancing Windows driver security: Removing trust for the cross-signed driver program (Microsoft Tech Community)](https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing-windows-driver-security-removing-trust-for-the-cross-signed-driver-pro/4504818)
16. [The Windows Driver Policy (Microsoft Support)](https://support.microsoft.com/en-us/windows/hardware/drivers/the-windows-driver-policy)
17. [TPM-Attest: Hardware-Rooted Integrity Attestation as a Kernel-Level Anti-Cheat Alternative for Linux (arXiv, 2026)](https://arxiv.org/abs/2609.20909)
18. [Narayanan, S. G., et al. (2026). You Shall Not Pass into Ring-0! A User Privacy-Friendly Anti-Cheat Architecture for Personal Computers. arXiv.](https://arxiv.org/abs/2609.17525)
19. [Analysis of kernel-level anti-cheat privacy and security issues (ISCC 2025 paper)](https://www.inf.ufpr.br/vinicius/files/ISCC-2025.pdf)
---
*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Software and programming › Application software by domain › Web browsers, clients, and user agents*
*Initially written Sep 17, 2026 · Reviewed: Sep 30, 2026; Oct 15, 2026 · Edited: Sep 30, 2026; Oct 15, 2026 · Last review: Oct 15, 2026*
*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*
License: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license