Riot Vanguard update bricks DMA storage devices via IOMMU

Riot Games deployed a Vanguard kernel (VGK) update on May 22, 2026 that activated motherboard IOMMU protections and disabled certain Direct Memory Access (DMA) cheat firmware on SATA and NVMe storage devices. Players using affected hardware reported blue screens and said they had to reinstall their operating systems to restore drive function.

DMA cheats use a secondary hardware device, often a PCIe card, to read system memory from outside the host PC. The cheat firmware runs on the add-on hardware or a connected second computer to pull in-game data without running software on the target machine. Because those devices operate independently of the main PC’s operating system and drivers, they have been difficult for software-only anti-cheat systems to detect.

When Vanguard’s kernel component identified what it flagged as suspicious DMA behavior, it issued an IOMMU restart. IOMMU, a hardware feature on many modern motherboards, controls which peripherals can access which parts of physical memory. Users report that the restart left the DMA-capable storage devices in a state where their firmware no longer allowed the drives to operate normally, producing kernel panics or blue screens even after Valorant was closed or Vanguard was removed.

A security researcher using the name Osisada posted findings online and in community forums describing how the update interacted with DMA-capable SATA and NVMe devices. Multiple affected users reported that simple reboots or uninstalling Vanguard did not restore the drives. Reported recovery steps required a full operating system reinstall or replacing the hardware.

Riot’s anti-cheat team wrote that the update raises the cost and risk for cheaters and warned that it will not end DMA cheating entirely, noting that developers of cheat firmware may create new variants to evade detection. The company has not published a step-by-step recovery guide for users whose hardware became nonfunctional after the update.

Analysts and participants in hardware and gaming communities noted that DMA setups typically cost several hundred dollars. Rendering those devices unusable increases the financial consequences for users who employ them for cheating compared with account bans. Hardware-level countermeasures and hardware bans have appeared in other parts of the industry.

The update affects systems where storage devices or DMA adapter hardware run modifiable firmware and can present themselves as ordinary peripherals. Because the reported corruption occurs at firmware or hardware interaction layers below the operating system, standard software updates or driver reinstalls do not appear to repair the affected devices.

Earlier this month, Riot previewed LoL Patch 26.11, shifting Deathfire Touch to magic damage and limiting balance to six champions.