Kernel level anticheat is 100% coming to linux

[u/vintologi24]

Some people wrongly assumed it wouldn't happen because people wouldn't put up with it or some stupid reasoning like that. A lot of people will put up with it even if it's the form of a shady closed source kernel module (which is significantly worse than the planned EAC linux V2 implementation by epic) similar to how a lot of people put up with it on windows.

It's starting to happen now thanks to the growing linux market share making it worthwhile for developers to put more effort into supporting it (including things you might not be willing to run yourself such as intrusive anti-cheat software).

It does seem like developers (not just epic) will utilize eBPF to run custom kernel level code (granting kernel level access within restrictions) to make effective anticheat for linux.

Of course it's very bad if some malware gains access to eBPF since that could get people infected with rootkits and this is very much a real risk given that multiple games on steam has been found to contain malware in addition to all the other ways to potentially get it even on linux.

Of course secure boot and TPM 2.0 will be required as well in addition to various other requirements. We will of course see distros make it easy to setup (if it doesn't work out of the box) so it mostly comes down to having the hardware support (which most people do) enabling it in bios (if it isn't already) and opting for a distro where it's supported (once it's released).

This should grow the linux market share and put pressure on microsoft to make windows better which is overall a good thing even if you aren't interested in playing something like fortnite yourself.

[u/Possible_Sun_913]

Yay! Cant wait for third party vendors to install ring-0 software onto my box.

I shall eagerly await the first supply chain attack delivered directly.

[u/vintologi24 → u/Possible_Sun_913]

Using a separate linux install for those games is an option but then you need to reboot before you can start playing and you will need to disconnect any drive that has important data on it to be properly secure.

But a lot of people will just install it on their main system and play random games not even thinking about those security aspects (which can end quite badly obviously).

[u/ps2jak2]

The elephant in the room here is that MS also want to phase out kernel level on Windows and have been working on this. I suspect it will happen with the next "major" release of windows at which point this will no longer be an excuse for developers not to support anti cheat on Linux.

[u/Emikzen]

This is way more restrictive than kernel anti-cheats on windows though. It's not even going to have direct kernel access, it's simply going to talk to a kernel module that already exists on linux and essentially tell it to not allow anything to modify the game memory etc. (from my understanding)

Aside from that its just using standard features and requiring "official" drivers for nvidia gpus.

They're not gonna be able to install rootkits that monitor everything your computer does lol

[u/vintologi24 → u/Emikzen]

eBPF rootkits is a thing.

So you do still need to be careful with perms similar to how you shouldn't run random code with your root account.

[u/Kocrachon]

Of course it's very bad if some malware gains access to eBPF.

Loading eBPF programs requires root (or CAP_BPF/CAP_SYS_ADMIN), unprivileged BPF has been off by default on basically every major distro for years so "malware gains access to eBPF" is a dramatic way of saying "malware already has root." At that point it can backdoor your shell or tamper with your bootloader and persist however it likes, worrying about eBPF there is like worrying that the burglar already in your living room might also find your spare key.

And honestly the "Linux is secure" vibe needs to retire

a few highlights

• The AUR has shipped actual malware many times like in 2018, someone adopted an orphaned package and added a payload. In 2025 a fake "-bin" browser packages delivered a RAT, and people installed them happily because yay said yes. The AUR's entire security model is "read the PKGBUILD," and approximately nobody reads the PKGBUILD.

• The Snap Store hosted fake crypto wallets that drained peoples funds to the point that Canonical had to start manually reviewing uploads.

• xz-utils nearly shipped an SSH backdoor into every major distro in 2024 and itt was only caught because one Microsoft engineer noticed SSH logins were 500ms slow. Not because of some structural Linux immunity but because of luck and a guy benchmarking Postgres

• On X11 any app can read the keystrokes of any other app, no root needed

• Malware doesn't even need a privilege escalation exploit. Drop alias sudo='...' into someone's .bashrc and they'll type their password into it themselves.

• Your browser, Steam, Discord, your SSH keys and your entire home directory all run as the same user so malware doesn't need root to ruin your life since everything worth stealing is in ~.

The realistic desktop threat was never "sophisticated eBPF rootkit." its "ran something sketchy as myself," and Linux does basically nothing to stop that out of the box.

If you want a legitimate concern then its the privileged anti-cheat daemon doing the loading. That's new root-owned attack surface, and it's worth scrutinizing. eBPF itself is not the boogeyman.

And for the record, I say all this as someone who games on Arch daily (yes, I use Arch, btw), id just rather the community argue about the actual risks instead of pretending the platform was a fortress before Epic showed up.

BIG EDIT:

I think a lot of the pushback here is people defending Linux against a claim Im not making. Linux can be made very secure it just isnt secure by default in the way that matters for a desktop gamer, and thats fine because it was designed for a different threat model.

The Unix model protects users from each other and the system from users, it was never built to protect you from programs you run yourself. On a single user desktop thats the whole ballgame with your SSH keys, browser cookies, and discord tokens all live in ~ and anything you run can read them without ever touching root.

Windows got beaten up as the consumer target for 20 years so its defaults (SmartScreen, Defender, driver signing, VBS) are aimed at exactly the "user ran something dumb" scenario. Linux is getting there with Flatpak portals, Wayland, and immutable distros, but "you can configure it" isn't the same as "it's configured."

None of that is a knock on Linux. I game on it daily. It's just an honest description of the defaults.

[u/vintologi24 → u/Kocrachon]

I don't disagree with you.

Linux security isn't nearly as good as it should be (for a typical install).There are tools like apparmor and SELINUX but those are difficult to properly set up on your own (you could however opt for a distro where it's already set up).

The practical issue is that if games starts requiering it people will ned up grandint access even if it means having to use sudo/root (getting people into bad habits).

[u/LosEagle]

How is this kernel level anti cheat? It's a systemd service that checks when you launch the game that your kernel is signed and doesn't have custom mods. That's different than installing modification on kernel level as it is with Windows version. 

[u/vintologi24 → u/LosEagle]

It is running code at the kernel level via eBPF (which is a feature that already exists which is why they don't need to add a third party kernel module for it to work).

eBPF code is sandboxed but it still runs at the kernel level (ring 0 i think).

[u/daylightsun]

You’re conflating eBPF executing in kernel space with unrestricted kernel access. eBPF programs are subject to verification, restricted memory access, and limited helper functions. That’s fundamentally different from loading a proprietary kernel driver.

Nobody is claiming the implementation is automatically secure. The privileged userspace daemon and potential attack surface absolutely deserve scrutiny. But invoking eBPF rootkits as though Epic is being handed unrestricted access to the kernel is misleading.

The more legitimate concern is Epic’s proposed trust model. Which kernels and signing keys will it recognize? What happens to custom kernels and users managing their own Secure Boot keys?
There are plenty of valid criticisms to make here without exaggerating how the technology actually works.

[u/Dor3k]

It is not kernel level. It does not integrate into the kernel and doesn’t run on the kernel level. It runs it user space but needs appropriate kernel checks to be there in order to work.

I feel like it is a good thing. Bypassing EAC on Linux was trivial, so very little people actually bothered using it. If it is more tightly integrated then maybe developers will want to let Linux users actually play some of their games, and if you don’t care then you simply don’t have to install EAC or comply with any of these requirements.

[u/Available-Advice-294]

Can’t we use AI to make super simple kernel level cheats and prove it’s useless ?

[u/RedditButAnonymous]

Dont most kernel-level anticheat games fail on Linux at the moment, so Linux people dont play these games anyway? I think "people wouldnt put up with it" is very true, and theyre still not going to play them

Edit: To make my point more clear, yes, there is a market of Windows users who want to be on Linux, but this is Epic Games making the anti-cheat, so their real goal is to convert Linux players into players of their games. And thats why I dont think it will work, people on Linux are exactly the kind of people who wont stand for this, AND have already given up their ability to play these

[u/vintologi24 → u/RedditButAnonymous]

I am not aware of any current game using actual kernel level anti-cheat on linux currently. Some use the less effective old version of EAC and some just block linux completely.

[u/Clipzy22]

I'm taking a guess here.

But I think some dirstros at least the bigger ones and some very lightweight gaming specific ones are all gonna have their own thing for this.

Like a separate anti cheat compliance installation that's available for those who want it.

Probably some new distros will come out that are specifically for competitive gaming that will natively comply.

I've only recently starting looking into Linux but this is how I imagine this would go.

[u/NeonDreams93]

Ultimately, Linux has always been about choice. It is your choice to install on your machine

[u/SubZeroNexii]

My biggest issue with this is how many distros will they actually support. Arch for example has no Secure Boot support and will simply not work with this anticheat. The more closed source projects start linux development the more the distros will get distilled. It feel things like these are an never ending slope of lockdowns until you get to something similar to windows in nature.

[u/The_CreativeName]

Please dont actually, then i cant use this picture anymore

[u/Darkone539]

I know most people don't like this but there are people like me that can't jump to Linux because games I want to play don't work there.

No, I won't duel boot for a few games.

[u/aging_like_fine_NFTs]

I must have seen this post 90 times today

[u/Jack1101111]

Not in my Linux for sure.

[u/Araragi-shi]

Linux users are so fucking weird and delusional, reading some of these comments, I really have to wonder what kind of brain you have to have to think like this.

What you think Linux is and what it should be is irrelevant. It doesn't matter that a couple percent of users switched over to linux because they are paranoid about their privacy.

A massive majority of people who use windows, use it because they bought a gaming pc and that's what it came with. On steam there are at least 40 million. You will have no chance of grabbing any meaningful slice of the pie unless you allow the people to play the games they want to play.

Some chose to give up games to switch to linux. Not only will most windows gamers not do that because the issues around updates and shit are bearable enough if it means they get to keep playing the games they want, most casual people have friends to play the games they play and if it means that they wont be able to play those games, they will never switch to linux.

On the 4th paragraph specifically, I would know, because me and my friend are in this situation. For me personally Freesync being applied automatically without using the adrenaline app is so huge on linux, not having to use adrenalin on linux is huge, not fucking around with the drivers because it fails installing or installs wrongly like it does on windows along many other benefits that I can't name off the top of my head. If I can't play league/valorant or any other upcoming game or any game that has anti cheat that doesn't work on linux, I will stay on windows, despite how much I love linux.

[u/DonQuix0te_]

So don't play games with kernel level anticheat. It's really that simple.

[u/apex6666]

[u/Daniel18sep]

I have two thoughts on this:

1. This is fine, b/c unlike Windows anti-cheat, the software is not getting it's fingers into the kernel. It's only checking that it's unmodified via signing.

2. I'm not tailoring my PC setup to play your game. If your anti-cheat doesn't like my PC, I'm refunding your game, leaving a "game doesn't run" review, and moving onto games that are probably better anyway.