Gaming & Internet Culture · gaming

By Deimos EMK · Published Nov 13, 2026 · Updated Nov 13, 2026 · 6 min read · Sourced & fact-checked

Photo: Ron Lach, via Pexels

• StatusMainstream
• Typeadjective
• Categorygaming
• LaneGaming

See it in action

Video: I Hate Kernel-Level Anti-Cheat, Here's Why:, embedded from its original platform.

What it means

In gaming, "kernel-level" almost always modifies "anti-cheat" and refers to a driver that runs in the operating system's kernel space, Ring 0 on x86 CPUs, instead of the user space (Ring 3) where normal applications live. Traditional anti-cheats like Easy Anti-Cheat or BattlEye operate at Ring 3, meaning they can only inspect processes that run at the same privilege level.

A kernel-level anti-cheat loads a signed kernel driver at system startup, before any game launches, and can monitor low-level system calls, memory mappings, driver loads, and hardware interrupts. This lets it detect and block cheats that themselves run in kernel mode, such as DMA cheats, hypervisor-based cheats, or rootkit-style injectors that would be invisible to a user-mode scanner.

Because the driver runs with full system authority, it can also prevent unauthorized drivers from loading and enforce secure boot requirements, which is why games like Battlefield 6 now demand secure boot be enabled in UEFI before the client will even start.

The most prominent kernel-level anti-cheat is Riot Games' Vanguard, introduced with Valorant in April 2020 and later extended to League of Legends. Vanguard's always-on design, it initializes at boot and stays resident, sparked immediate backlash over privacy, performance, and the sheer amount of trust required: a third-party kernel driver can read any memory, hook any system call, and survive a full OS reinstall if not cleanly uninstalled.

Embark Studios followed suit with The Finals in 2025, announcing a kernel-driver anti-cheat to combat rampant wallhacks and aimbots, while acknowledging it would break official Linux/Steam Deck support (though they pledged best-effort compatibility via Proton). EA's Battlefield 6 beta debuted the Javelin anti-cheat with a kernel component and a mandatory secure boot flag, triggering a Steam review bomb on Battlefield 2042 from players locked out on older hardware or Linux.

In each case, developers frame the move as necessary for competitive integrity; players counter that the invasiveness is disproportionate, especially when cheats still appear, as Notebookcheck documented, wallhacks were active in the Battlefield 6 beta despite the aggressive kernel-level requirements.

The controversy centers on three intersecting risks. First, security: any vulnerability in a kernel driver is a Ring 0 exploit. The 2024 CrowdStrike outage, caused by a faulty kernel sensor driver, demonstrated how a single bad update can crash millions of machines; Genshin Impact's mhyprot2.sys driver was previously abused by ransomware to disable antivirus software.

Riot now runs a HackerOne bug bounty paying up to $100,000 for kernel-level code execution flaws in Vanguard, acknowledging the attack surface. Second, platform exclusion: kernel drivers are Windows-centric; Linux's decentralized kernel module policies and lack of a unified driver-signing authority make deployment difficult, so kernel-level anti-cheats effectively kill native Linux support and often break Proton/Wine translation layers.

Third, trust: players must believe the publisher will never misuse the driver for data collection, remote control, or DRM beyond anti-cheat. The term "kernel-level" has become shorthand in community discourse for "this game owns your PC while it runs," and it routinely triggers debates about whether the marginal cheat reduction justifies the systemic risk. [1][2][3][4][5]

The receipt

Original post, embedded from Youtube, linked and credited. Visuals on this page are shown for commentary and identification.

The receipts

Documented, dated uses of “kernel-level”: each quote is verbatim from the linked source.

Seen in use

People using “kernel-level” in their own posts, each linked to the post itself. These are examples of use, not sources.

Every quote above passed the same verification gate this site publishes under: real source, real date, copied verbatim. See the editorial policy.

Why it's everywhere

Kernel-level anti-cheat is everywhere right now because cheat developers have moved into kernel mode themselves. DMA cheats that read memory via hardware devices, hypervisor-based cheats that virtualize the game, and signed driver exploits have rendered user-mode detection largely ineffective. Major competitive titles, Valorant, League of Legends, The Finals, Battlefield 6, and Fortnite's upcoming Linux support with kernel-level AC, are all adopting or expanding kernel drivers in the last 18 months.

This arms race pushes the technology from niche (Vanguard 2020) to default expectation for any serious FPS or MOBA. Simultaneously, the Steam Deck's popularity and the growth of Linux gaming via Proton have made the compatibility fallout visible to a much larger audience; every kernel-level announcement now triggers immediate "will this run on Deck?" threads.

The current spike in discussion is fueled by high-profile failures and visible trade-offs. The Battlefield 6 open beta showed that even an aggressive kernel-level anti-cheat with secure boot enforcement didn't stop wallhacks on day one, undermining the "silver bullet" narrative. The Finals' community manager had to publicly reassure Linux players they wouldn't be abandoned, highlighting the platform-exclusion cost.

Riot's $100k bug bounty for kernel-level code execution in Vanguard signals that even the originators treat the attack surface as critical. Meanwhile, Steam reviews and Reddit threads fill with "kernel-level anti-cheat" as a search term, players now check for it before buying, and a kernel-level requirement is treated as a con in purchasing decisions.

The term has graduated from technical jargon to a consumer-rights flashpoint: it appears in patch notes, Discord announcements, and Steam store tags as a decision factor, not just an implementation detail.

How it gets used

Used seriously in technical discussions, purchase decisions, and privacy debates; not a meme but a hard line many players draw, "no kernel-level, no install."

• “Valorant's kernel-level anti-cheat Vanguard loads at boot, so cheats can't even start before the game does.”Reddit thread explaining why Vanguard is harder to bypass
• “The Finals devs say they need kernel-level access to stop the aimbot epidemic, but Linux players are worried they'll get locked out.”Discord announcement discussion about update 7.3
• “Battlefield 6's kernel-level Javelin anti-cheat demands secure boot, yet wallhacks were still everywhere in the open beta.”Steam review or Notebookcheck comment section
• “If a kernel-level driver has a vulnerability, attackers get Ring 0 access, that's why the CrowdStrike outage scared everyone.”Twitter/X thread on Vanguard bug bounty
• “Steam reviews got bombed because the kernel-level AC requirement bricks the game on Steam Deck.”Steam community hub for Battlefield 2042 after BF6 beta

Frequently asked