Riot's Valorant rootkit is active from boot and actively monitors everything you run and will block things it doesn't like or doesn't recognize.

Most of the other kernel anticheat rootkits are more polite and don't run until a game starts them, at least.

In general having a bunch of random stuff from video games running with kernel permissions is spooky. You never know whether someone will find an exploit in one of them, or if it will cause performance, stability or data integrity problems.

> Riot's Valorant rootkit is active from boot and actively monitors everything you run and will block things it doesn't like or doesn't recognize.

Honestly, if I was responsible for building an anti-cheat system this is the way I'd go about it. Anything that can run that you don't know about (e.g. because it ran before you started) is a potential risk.

Cheaters now exploit boot loaders to side step this, funnily enough

Doesn't giving kernel mode access mean that if the game developer's CI is hacked, an attacker could push full compromise exploits down the channel?

Aren't there some security benefits from trying to confine apps to user land?

Userland can run DoS attacks, it can mine crypto, it can run keyloggers, it can steal, encrypt, and delete your files, it can make your system not properly startup, it can replace sudo or other programs that ask for passwords with a custom version, it can steal whatever's on your clipboard, it can infect other operating systems (depends how they are mounted), and much more.

User land can also gain kernel access pretty trivially