Anti-cheat kernel drivers have become PC gaming's biggest attack surface

Kernel-level anti-cheat exists because software running in user space simply cannot see everything a cheat can do — direct memory access hardware, for instance, reads game memory through a separate PCIe device that never touches the monitored process at all. To catch that, publishers had to go where the cheats live: Ring 0, the same privilege level as the operating system kernel itself. That decision has made anti-cheat drivers one of the most consequential pieces of software running on a gaming PC, and 2026 made clear exactly what that trade-off costs.

The Same Access That Catches Cheaters Can Be Weaponized

A kernel driver with Ring 0 access is functionally indistinguishable from a rootkit in terms of what it's technically capable of — the difference is purely about intent and whoever controls it. That's not a hypothetical concern. Genshin Impact's anti-cheat driver has previously been abused by ransomware operators specifically because it was a signed, trusted kernel component that could disable security software once loaded — a Bring Your Own Vulnerable Driver (BYOVD) attack. A local privilege escalation flaw in Easy Anti-Cheat demonstrated the same category of risk from the defensive side: a bug in the anti-cheat itself, rather than abuse of a legitimate one, handing an attacker kernel-level control.

2026's Vulnerability Disclosures Kept Coming

In December 2025, Riot Games' own security researchers disclosed a serious UEFI firmware flaw connected to Vanguard, Riot's kernel-level anti-cheat — notable because it was the vendor's own team finding the hole in its own deeply privileged software, at the firmware layer beneath the OS. The pattern continued into August 2026 with the disclosure of "Download More RAM," a critical flaw exploiting unprivileged consumer memory modules to bypass Virtualization-based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI) — the exact Windows protections kernel anti-cheat depends on. The attack can disable kernel-level anti-cheat entirely by tampering with the protections underneath it. Microsoft shipped mitigations for the associated CVE-2026-23670 in April 2026, but the disclosure underscores how anti-cheat security is now entangled with the security of the entire Windows virtualization stack, not just the driver itself.

Separately, a Windows kernel driver zero-day, CVE-2026-68820, actively exploited for privilege escalation, was patched in the same August 2026 update cycle — a reminder that the attack surface isn't limited to anti-cheat vendors specifically. Any kernel driver is a potential entry point, and gaming PCs now run more of them than most consumer machines.

When Anti-Cheat Breaks the Games It's Protecting

The risk isn't purely adversarial. The August 2026 Windows 11 security update KB5121003 caused game crashes and anti-cheat malfunctions for some players, traced to a compatibility conflict with a third-party kernel-level port access driver. When your security software runs at the same privilege level as the OS itself, an unrelated OS patch can break it — and a broken anti-cheat driver can crash the very games it's meant to protect. That's a cost publishers accept implicitly every time they ship a kernel-level solution.

The Industry's Answer: Demand More Trust, Not Less

Rather than retreating from kernel-level anti-cheat, publishers are doubling down on the hardware trust required to run it. Riot introduced "Vanguard On-Demand" in June 2026, which loads the kernel driver only while a Riot game is actively running and unloads it on exit — but only on machines meeting a strict bar: Windows 11 25H2, Secure Boot, TPM 2.0, VBS, HVCI, and IOMMU all enabled. Anti-cheat vendors are increasingly inspecting the PCIe device tree and IOMMU state directly to catch DMA-based cheat hardware that software-only detection can't see.

That trend has a real cost for players: a growing list of competitive titles now simply refuse to launch on machines that don't meet the full hardware security bar, which effectively obsoletes some older PCs and firmware configurations for competitive play, regardless of raw performance. It also means enabling Secure Boot and TPM 2.0 has gone from an OS-upgrade requirement to a per-game gatekeeping mechanism.

What This Means for Players and IT Admins

If you play competitive titles with kernel-level anti-cheat, treat your BIOS security settings as part of your game's system requirements, not an optional hardening step — Secure Boot, TPM 2.0, and VBS/HVCI are increasingly load-bearing for whether the game launches at all. If you administer shared or managed PCs — internet cafes, LAN centers, corporate machines that also run games — audit which kernel-level anti-cheat drivers are installed and keep them current; a stale anti-cheat driver is now a documented BYOVD risk on its own, separate from whatever exploit protection it's supposed to provide. And treat any Windows security update on a gaming machine as a compatibility risk worth testing before wide rollout, not just a routine patch — 2026 has shown that OS-level and anti-cheat-level privilege changes can collide in ways neither vendor fully controls.