When the anti-cheat driver becomes the vulnerability
Kernel anti-cheat drivers run with the highest privileges on your PC. In 2022 one of them was abused by ransomware, showing the cost of that trust.
Kernel-level anti-cheats are powerful because they run with the highest privilege level on your machine. That same power is what makes a flaw in one so serious.
A real example
In 2022, security researchers reported that ransomware attackers were abusing the kernel driver that ships with Genshin Impact's anti-cheat to switch off security software on infected Windows PCs. The driver was legitimately signed, so it could be loaded easily, and its capabilities were then used for something it was never meant for.
Why this matters on Linux
Anti-cheats that work in user space, like Valve's VAC, avoid this class of problem. Easy Anti-Cheat and BattlEye use a user-space runtime on Linux for the same practical reason. Learn the difference in kernel vs. user-space anti-cheat.
The game involved is tracked on its Genshin Impact page.