every single driver is "kernel level". every single anticheat on linux runs in userspace. it's impossible to have a functioning kernelspace anticheat on linux, because local user can just replace their kernel, recompiling it from source with cheats already present in it. kernel extension modules cant invalidate that code. there are ways of scanning kernel and modifying it (e.g. Livepatch), but using Livepatch for that makes what Vanguard did with their early booting and security enforcement (before windows integrated solutions that now make it so Vanguard can be disabled and reenabled without having to reboot) a gentlest thing in the world. Not every Linux user is a cheater, cheating on Linux is trivial compared to Windows because you can just replace the kernel of your operating system.
While kernel customization on Linux is technically possible, it’s not as simple as flipping a switch for the average player. To bypass anti-cheat via a custom kernel, a user would still need to manually compile a patched kernel, maintain it across system updates, and enroll custom MOK (Machine Owner Key) certificates if Secure Boot is enabled.
The real reason Windows is the center of the cheat ecosystem comes down to economics and ease of distribution: 99% of the market is on Windows, where cheat developers can easily package user-friendly executables or leverage vulnerable Windows drivers (BYOVD exploits) for profit. Linux kernel tampering exists in theory, but as a practical mass-market cheating vector, it's hindered by a tiny user base and high technical friction for casual users.
