Kernel-level anti-cheat

Some anti-cheats do not just watch the game, they move into the basement of your operating system. On Linux, that basement has a different address.

The short answer

A kernel-level anti-cheat installs a driver that runs in Windows kernel mode, the privilege level of the core operating system, next to a normal program in user mode [1][3]. Valve writes that kernel-space anti-cheat solutions are not currently supported by Proton and recommends user-space components instead [2]. Our assessment: if a multiplayer game that matters to you uses such a driver, keep a Windows installation for it and check its status before you switch.

How it works

1. Two privilege levels. Applications run in user mode, each in its own private address space. All code in kernel mode shares a single address space, and if a kernel-mode driver crashes, the whole operating system crashes [1].
2. Why vendors go that deep. Riot argues that an anti-cheat running only in user mode can be undermined by a cheat running at a higher privilege level [3]. Its Vanguard consists of a user-mode client that runs the detections and a kernel-mode driver that validates memory and system state; the driver starts at boot so that no cheat loads before the client [3]. Riot says the driver is signed through Microsoft's code-signing process [3].
3. Boot integrity on top. Riot's support page says Vanguard automatically enables security standards similar to Secure Boot while it is on [4]. EA requires Secure Boot for Battlefield 6 and names kernel-level cheats, rootkits and tampering with anti-cheat systems among the threats it targets [5].
4. Why Proton stops here. Proton runs Windows programs on Linux through Wine, and Valve says user-space anti-cheat components can typically run in that environment [2]. Kernel-space solutions are not supported [2]. Even Easy Anti-Cheat and BattlEye only work under Proton when the developer enables Linux support for the specific game [2]. Our reading: the name of the anti-cheat does not decide whether a game runs; the developer's choice does.
5. The crowd-sourced picture. On 25 Oct 2026, the community list Are We Anti-Cheat Yet? counted 196 games as supported, 280 as running, 636 as broken and 53 as denied [6]. It is crowd-sourced and not confirmed by publishers [6]. Valorant, which uses Vanguard, is listed as denied [6].
6. The trade-off. A kernel driver needs trust, because a faulty driver can take down the whole system [1]. Riot says the Vanguard driver does not collect or send any information about your PC back to Riot and can be uninstalled at any time, but Valorant will not run without it [3].

A practical example

You want to move your gaming PC to Linux. First list every online game you play. For each one, check the publisher's support pages and the community list for its status, and treat entries without a date with caution [6]. A game such as Valorant, with a kernel driver that loads at boot and a "denied" entry, stays on Windows [3][6]. Games with Easy Anti-Cheat or BattlEye only count as candidates once the developer has switched on Proton support [2]. This is a planning example, not a test on our own hardware.

Checklist

• Look up the anti-cheat status of each online game before you remove Windows [6].
• Treat "denied" as a decision by the publisher, not as a bug that a Proton update will fix [2][6].
• Keep Windows on its own drive if you need games with kernel drivers (our assessment).
• Check whether a game on Windows also requires Secure Boot or a TPM [5].
• Never try to fake or bypass an anti-cheat; publishers treat tampering as cheating [5].
• Uninstall a kernel anti-cheat through its official uninstaller when you stop playing [3].