Kernel Anti-Cheat Is an Overreach

I want to preface this with the fact that I’m not a gamer. I’m game-curious, but I often lack the time to really devote. But a close friend of mine games pretty frequently and he brought me (a bit) up to speed recently. I hobbled together a computer from various parts (and then overpaid for a GPU), I got excited about spending some liesure time playing. But during the process I realized that in order to play many of the biggest games, you are forced to install a closed-source driver and provide root access to your operating system. So I decided to do some research and found that the owners of this anti-cheating software include a Chinese firm on a US defense list, a Saudi sovereign wealth fund, and a private-equity chain.

Furthermore, it hasn’t stopped cheating. They largely moved to external hardware that bypasses kernel anti-cheat.

What “kernel anti-cheat” means

These are ring-0 drivers. They run with the same privilege level as the Windows kernel, with full access to memory, processes, loaded drivers, the filesystem, and hardware. They are closed source so no one can review them; you can only review their policies. Multiple games (and some of the largest coming soon) now also require TPM 2.0 and Secure Boot, and use remote hardware attestation to confirm your machine’s boot state before letting you play.

Who owns them

Here’s a breakdown of the most prominent systems.

Anti-cheat	Owner chain	Control nationality	When it runs	Popular titles
Vanguard	Riot Games → Tencent (100%)	China	Boot-start driver by default	Valorant, League of Legends, Teamfight Tactics
FACEIT / ESEA	ESL FaceIt → Savvy → Saudi PIF	Saudi Arabia (state)	Kernel driver records at all times	CS2 (FACEIT/ESEA ladders), Dota 2 (FACEIT)
Javelin	EA → PIF / Silver Lake / Affinity (pending CFIUS)	US now → Saudi (prospective)	Whole game session	Battlefield 6 / REDSEC, EA SPORTS FC 26, Madden NFL 26, F1
Easy Anti-Cheat (EAC)	Epic Games (Tencent ~40%, no board seats)	US (Chinese minority)	At game launch	Fortnite, Apex Legends, Rust, Elden Ring, Dead by Daylight
RICOCHET	Activision → Microsoft	United States	At game launch	Call of Duty: Warzone, Black Ops 6/7, Modern Warfare III
Denuvo Anti-Cheat	Irdeto → MultiChoice → Canal+ (Bolloré)	France	Varies	The Finals, ARC Raiders*
BattlEye	BattlEye Innovations (Bastian Suter)	Germany	Launch only, inert otherwise	PUBG, Rainbow Six Siege, Destiny 2, Escape from Tarkov, DayZ

• ARC Raiders runs EAC plus Denuvo AC (added May 2026 after The Finals rollout), and Vanguard covers all Riot titles via the shared client.

Specifics:

• Vanguard is owned outright by Tencent. [1] In January 2025 the US Department of Defense added Tencent to its list of “Chinese Military Companies.” [2] Vanguard’s vgk.sys is a boot-start driver that loads before most of Windows and stays resident whether or not you’re playing. [3]

• FACEIT and (pending) Javelin both trace to Saudi Arabia’s Public Investment Fund, chaired by Mohammed bin Salman. PIF already owns FACEIT via Savvy Games, and FACEIT’s kernel driver records continuously. [4][5] The EA buyout ($55B) is still under US CFIUS review — the sticking point is player data — with an outside date of September 28, 2026. [6][7]

• EAC is Epic’s, and Epic is roughly 40% Tencent, though Tencent gave up its board seats after a US antitrust objection. [8] EAC ships in 180+ games, which makes it the one most people are running without knowing it. [9]

• RICOCHET (Call of Duty) is Microsoft’s, the most accountable owner here.

• Denuvo Anti-Cheat now traces to France’s Canal+ (Vincent Bolloré), which acquired its parent, MultiChoice/Irdeto, in December 2025 — a chain often still misreported as Tencent-linked. [10]

• BattlEye is the only one with no corporate or state parent — a German sole proprietorship. [11] It’s also the least invasive: it loads with the game and is otherwise inert. It is proof that a purpose-limited kernel anti-cheat is possible; the others simply chose differently.

Ownership matters because of what a controlling entity can be forced to do with that access. Under China’s 2017 National Intelligence Law (Article 7), organizations must “support, assist, and cooperate” with state intelligence work — and keep it secret. [12] Saudi Arabia offers a demonstrated precedent rather than a statute: in 2019 the US charged former Twitter employees with spying for the kingdom, using insider access to unmask anonymous dissidents, several of whom were later imprisoned. [13]

The United States has compulsion tools of its own — the CLOUD Act, FISA — so Microsoft is not beyond government reach either. The difference is oversight: these run through published law, warrants, and adversarial courts, and companies can report them in aggregate transparency reports, so US compulsion leaves a trail and can be challenged. [14]

What they collect

Independent analysis (ARES 2024, “If It Looks Like a Rootkit…”) tested these drivers: [15]

• All of them exfiltrate system information.

• EAC generates a hardware ID and logs every driver and module in memory, sending it to the server continuously — whether or not you’re suspected of cheating. On a ban it fingerprints CPU, GPU, MAC addresses, and drive serial numbers — identity that outlives the account.

• Vanguard and FACEIT meet the paper’s threshold for rootkit-like behavior, including hiding themselves from other processes.

• Collection is inherently system-wide: filesystem filters watch all file operations; callbacks fire on every process and DLL load.

Riot says the kernel driver itself ‘does not collect or send any information’ — technically the user-mode client does the reporting. Which is a distinction that does not ease my mind one bit. [16] EA’s free Battlefield 6 spin-off, REDSEC, launched without the kernel anti-cheat disclosure shown on the main game’s store page, so players only found out Javelin was installed and running after downloading it. [17] RICOCHET banned a disabled player’s QuadStick adaptive controller (May 2026), flagging it as an input-modification device. [18] Separately, Epic and Activision both share account data with advertising and analytics partners; one privacy review scored Epic 24/100. [19] None of this is cheating-related. It’s just what the access enables, and I’d argue one of the primary goals of forcing anti-cheat on consumers.

Even if you trust every vendor completely, a signed kernel driver is an attack surface. In 2022, Genshin Impact’s anti-cheat driver mhyprot2.sys was used by ransomware to disable antivirus from kernel mode. The game didn’t need to be installed; the driver worked on its own. [20] EAC’s service had a local privilege-escalation flaw (CVE-2021-47739, CVSS 8.5) found in 2021 but only assigned a CVE in December 2025 [21] and researchers have found weaknesses in BattlEye that let an attacker load a malicious unsigned driver. [22] Every one of these is a ready-made kernel foothold sitting on millions of machines so I can only imagine it is quite the succulant target.

Meanwhile, Microsoft may be backing away from the model. After the 2024 CrowdStrike outage (not anti-cheat, but a kernel driver) that bricked around 8.5 million machines worldwide, Microsoft began moving security software out of the kernel into user mode, and has said it may eventually restrict third-party kernel access outright. [23]

Cheating remains

To understand why the requirements keep escalating, follow the arms race. Cheats started in user space, so anti-cheat moved into the kernel to see them. Cheats followed into the kernel, and then below it into hypervisors — so anti-cheat added hypervisor detection and began demanding a verified boot chain. Every time the cheat drops a layer deeper, the anti-cheat has to demand more privilege and more hardware trust to keep watching. That is what TPM 2.0, Secure Boot, remote attestation, IOMMU enforcement, and now forced firmware updates actually are: anti-cheat chasing cheats further down the stack.

The current frontier is off the PC entirely. A DMA cheat is a separate FPGA card that sits in a PCIe slot and reads the game’s memory directly over the bus, while a second computer processes what it sees and feeds back aim and wallhacks — often through a device that emulates an ordinary USB mouse, so even the inputs look human. No cheat code runs on the gaming PC, so to a kernel anti-cheat the machine looks completely clean. These are not exotic: they are sold openly as plug-in cards, marketed as “undetected,” and have become the standard tool for serious cheating. [24]

Anti-cheat has responded by trying to inspect the hardware itself — enumerating PCIe devices, checking IOMMU state, mandating Secure Boot — and by 2026 it had started catching some DMA setups. But that escalation lands on everyone. The cost is paid by ordinary players in hardware lockouts, firmware updates, and excluded machines, while roughly 60% of gaming PCs have IOMMU turned off anyway. [24] The requirements get more invasive every year; and like every cat and mouse game the determined cheater simply moves again.

The headaches this creates

All of that cost lands on the people the system is nominally protecting. The hardware requirements lock out Linux and the Steam Deck, and exclude older but perfectly capable machines. In late 2025, Riot went as far as pushing a UEFI firmware update to Valorant players to close a hardware attack — the first time an anti-cheat has reached below the operating system to change your firmware. [25]

False positives ban legitimate players — adaptive controllers, remapping tools, fan-control utilities, old drivers — and the resulting hardware bans outlive the account, sometimes following the machine to its next owner. Appeals are opaque: no evidence shown, no real recourse. The drivers conflict with virtualization (Hyper-V, WSL, VMs, cloud gaming), break unrelated peripherals, and add kernel-level scanning overhead to every session.

I ran into issues firsthand. During setup, I did a clean Windows 11 install, and tried to run Battlefield 6 (although it was not the first game I tested). Unfortunately the install was legacy MBR, and BF6’s anti-cheat (EA Javelin) requires UEFI Secure Boot — so I was forced to convert the disk with mbr2gpt and spent about an hour manually rebuilding the boot drive to work under UEFI. Even then, the machine kept dropping into a Windows recovery screen instead of booting the OS, and it wouldn’t stop until I disabled Secure Boot and updated Windows — an out-of-date Windows install was apparently enough to keep the machine from booting at all. Hours of low-level boot surgery, to play a game.

Extreme overreach

In short, a driver that loads at boot, records continuously, fingerprints your hardware, and reports back whether or not you are suspected of anything is not shaped like cheat detection. It is shaped like monitoring. And the companies holding that access are, mostly, companies that already make money watching you. Epic and Activision share player data with advertising and analytics partners. [19] Activision went as far as patenting a matchmaking system designed to nudge players into buying microtransactions — it says the patent was exploratory and never shipped, but a company patents what it is thinking about. [26] EA’s own User Agreement grants its anti-cheat permission to “monitor and collect” from your memory, processes, visuals, communications, and file storage. [27]

The access is broad, the owners’ incentives point toward using it, and there is no way for you to verify what it does. I have to assume that they are collecting data on systems they have access to unless they specifically say they are not. That is why I’ve come to read kernel anti-cheat as another channel for monitoring consumers — one that happens to sit at the most privileged layer of your computer, owned by state funds and advertising businesses, running on hardware you paid for.

So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private. People spend thousands of dollars on gaming hardware and expect it to be multi-use. Yet if you are going to play these games, I feel it’s 100% necessary to isolate them: dual-boot a second Windows install used only for gaming — or better, a separate machine — with nothing personal on it. Which is incredibly wasteful, and downright audacious from these gaming companies.

Further reading

• “If It Looks Like a Rootkit and Deceives Like a Rootkit” (ARES 2024) — the independent teardown behind most of the collection claims here.

• secret.club, “BattlEye anti-cheat: analysis and mitigation” — what one of these drivers actually does at ring 0.

• “The Rise of DMA Hardware” — why kernel anti-cheat is losing to external hardware.

• Hacker News: “Chinese-owned Riot installs rootkit on every League of Legends players’ computer” — the community argument, at length.

References

1. Tencent Now Owns 100% of Riot Games (Niko Partners). Confirms Tencent’s full ownership of Riot Games, developer of Vanguard.

2. Tencent shares plunge as U.S. puts video game giant on list of ‘Chinese military companies’ (Fortune, January 2026). US DoD Section 1260H “Chinese Military Companies” designation, January 2025.

3. Riot Vanguard (Wikipedia). vgk.sys boot-start kernel driver behavior and On-Demand mode.

4. Saudi-backed Savvy buys ESL and FACEIT (SportsPro). PIF ownership of ESL FACEIT Group via Savvy Games Group.

5. What is FACEIT Anti-cheat and how does it work? (FACEIT Support). Describes continuous kernel-driver data recording.

6. Proposed leveraged buyout of Electronic Arts (Wikipedia). $55B PIF / Silver Lake / Affinity deal, CFIUS review, timeline.

7. CWA president implores U.S. regulators to scrutinise EA buyout (Game Developer). National-security and player-data concerns raised to CFIUS.

8. Tencent gives up Epic Games board seats after US antitrust scrutiny (South China Morning Post). Epic ~40% Tencent stake; board seats relinquished under Clayton Act §8.

9. Every game with kernel-level anti-cheat software (Levvvel). EAC’s deployment across 180+ titles.

10. MultiChoice (Wikipedia). Canal+ (Bolloré/Vivendi) acquisition of MultiChoice/Irdeto, parent of Denuvo, completed December 2025.

11. BattlEye Imprint (BattlEye Innovations e.K.). German sole proprietorship, proprietor Bastian Suter.

12. National Intelligence Law of the P.R.C. (2017) (China Law Translate). Article 7 cooperation-and-secrecy obligations.

13. Former Twitter employees charged with spying for Saudi Arabia (Washington Post, 2019). Saudi insider access used to unmask dissidents.

14. CLOUD Act (Wikipedia). US compulsion reach over providers, and its statutory/judicial constraints.

15. If It Looks Like a Rootkit and Deceives Like a Rootkit: A Critical Examination of Kernel-Level Anti-Cheat Systems (ARES 2024, DOI 10.1145/3664476.3670433). Independent analysis of EAC, BattlEye, Vanguard, FACEIT data collection and rootkit-like behavior.

16. A Message About Vanguard From Our Security and Privacy Teams (Riot Games). Riot’s claim about what the driver does and does not send.

17. Battlefield 6’s anti-cheat feels like a punishment for genuine players — and it’s blocking SteamOS compatibility (TechRadar). Javelin’s Secure Boot requirement, SteamOS lockout, and REDSEC disclosure gap.

18. Call of Duty Streamer Wrongfully Banned Over Accessibility Controller (GamingHQ, May 2026). RICOCHET flagged a QuadStick adaptive controller as an input-modification device.

19. Epic Games Privacy Policy Review (Privacy Watchdog / terms.law). Privacy score 24/100; sharing with advertising and analytics partners.

20. Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus (Trend Micro, 2022). mhyprot2.sys weaponized via BYOVD.

21. Epic Games Easy Anti-Cheat Local Privilege Escalation via Unquoted Service Path (VulnCheck). CVE-2021-47739, CVSS 8.5, disclosed December 2025.

22. Battling The Eye: Exploring the Anti-Cheat Techniques of BattlEye (MATE 2025). Design weakness permitting a malicious unsigned driver to run.

23. CrowdStrike outage leads Microsoft to plan more ‘security capabilities outside of kernel’ (SC Media). ~8.5M machines affected; Microsoft’s move toward user-mode security.

24. The Rise of DMA Hardware: How External Devices Are Bypassing Game Anti-Cheat (GIS User, March 2026). DMA cheats evade kernel anti-cheat; ~60% of gaming PCs have IOMMU disabled.

25. Riot is forcing Valorant players to update their PC firmware to keep playing (TechSpot, December 2025). First anti-cheat to mandate UEFI/motherboard firmware updates.

26. Activision wins patent that uses matchmaking to make you want to buy stuff (PC Gamer). Patent (granted 2017) for matchmaking that pairs players to encourage microtransaction purchases; Activision says it was exploratory and unimplemented.

27. EA User Agreement (Electronic Arts). Section 7.C grants anti-cheat running at kernel/admin/user privilege the right to monitor and collect from RAM/memory, processes, visuals, communications, and file storage.