Kernel Access

Kernel access is not automatically reckless. Some security, virtualization, hardware, and anti-cheat systems have historically needed it. But code in the kernel runs across a boundary where an ordinary software failure can become an operating-system failure. The right question is whether that privilege is necessary, limited, and worth the larger blast radius.

The July 2024 CrowdStrike outage made that tradeoff visible. Microsoft estimated that the incident affected 8.5 million Windows devices. CrowdStrike's later root-cause analysis described a mismatch between the number of input fields a content interpreter expected and the number supplied by a new configuration, leading to an out-of-bounds read and a system crash.

The failure did not require malicious code. Trusted security software received a bad update while operating in a highly privileged part of the system. That was enough.

What Kernel Privilege Changes

An operating system separates the kernel from ordinary applications. User-mode software receives constrained interfaces for files, memory, devices, networking, and processes. Kernel-mode code can work much closer to the system core.

That access can make a feature possible or more effective. It also changes the consequences of a bug:

• a user-mode process can usually be terminated or restarted
• a faulty kernel driver can crash or destabilize the whole machine
• a compromised kernel component can bypass protections that constrain ordinary applications
• an update can affect every endpoint that receives it before operators can intervene

Code signing, staged releases, testing, and vendor reputation reduce probability. They do not remove impact.

The Anti-Cheat Example

Riot's Vanguard is a clear example of the privilege argument. Cheats can operate in the kernel, so an anti-cheat system that only observes user-mode behavior may be unable to see or resist them. Riot historically required Vanguard's driver to start during boot so it could establish trust before a cheat loaded.

That design is now becoming more conditional. Riot's 2026 description of Vanguard On Demand says supported Windows 11 systems can load the driver when the game launches, using Runtime Driver Attestation to verify what happened earlier in the boot process. Systems that do not meet the requirements continue to use the boot-start model.

The update is useful because it shows the real design goal: preserve the needed security property while reducing how long privileged code must remain active. Better hardware and operating-system evidence can narrow the privilege window.

Security Software Is Moving Too

Microsoft is pursuing a similar direction for endpoint security. The Windows Resiliency Initiative includes the Windows Endpoint Security Platform, which is intended to let security products run outside kernel mode while retaining the capabilities they need.

This is not a promise to remove every third-party driver, nor proof that all kernel work can move into user mode. It is a move toward smaller trusted surfaces and clearer isolation. If a capability can be exposed through a controlled operating-system interface, each vendor no longer needs to place as much proprietary code in the kernel.

A Practical Standard

For software makers, least privilege should apply to drivers as strictly as it applies to database roles and API tokens:

1. Use kernel code only for work that cannot be done safely through a narrower interface.
2. Keep the kernel component small and move policy, networking, parsing, and UI work into user mode.
3. Roll out driver and configuration updates in stages, with automatic halt conditions.
4. Make the component's purpose, lifecycle, and removal path clear to the user.
5. Revisit old privilege decisions as operating systems add safer APIs and attestation mechanisms.

For users and administrators, the practical step is inventory rather than panic. Windows can list drivers through Device Manager, system information tools, and driverquery. Remove abandoned utilities and hardware packages through their supported uninstallers, keep active drivers updated, and treat any new driver as a larger trust decision than an ordinary app installation.

The lesson from CrowdStrike is not that kernel software is always unacceptable. It is that kernel privilege converts a vendor's mistake into part of the operating system's failure domain. Every product that asks for that privilege should have to earn it.