Riot VGK update bricks DMA cheats, forces OS reinstalls

Riot Games deployed a Vanguard Kernel (VGK) update in May 2026 that disables a broad set of DMA-based cheat devices running on SATA and NVMe firmware. The update detects suspicious direct memory access activity, triggers an IOMMU restart and produces blue-screen crashes. Users report the connected DMA devices remain nonfunctional after the game is closed, after Vanguard is uninstalled and after system restarts. Several users say a full operating system reinstall is the only reliable way to get the devices working again.

DMA cheats use a separate piece of hardware, commonly a PCIe card with custom firmware, and a second computer to read game memory from outside the primary PC. That setup pulls data such as player positions without running software on the gamer’s operating system, so traditional anti-cheat scans have not detected it.

The VGK update looks for signatures of suspicious DMA activity and invokes the motherboard IOMMU, a hardware feature that controls which devices can access system memory. When the IOMMU restart is triggered, affected devices report errors and their firmware appears to be corrupted at a level users cannot repair without reinstalling the OS.

A hacking journalist known as Osisada posted details of the cheating method, and Riot confirmed it had learned of the technique and pushed countermeasures. Players on forums and technical communities reported mid-match IOMMU warnings followed by system crashes and nonfunctional storage devices.

Community responses have been mixed. Some users who oppose cheating welcomed the update, while others, including members of Linux and hardware communities, raised concerns about kernel-level software rendering hardware unusable. DMA kits for memory-reading cheats typically cost several hundred dollars, and several people noted that disabling the hardware raises the financial cost for anyone using these tools.

Riot’s Vanguard runs with deep kernel access, which gives the anti-cheat software visibility into low-level system behavior. Security researchers and anti-cheat developers expect developers of DMA firmware to attempt new variants to avoid the IOMMU triggers, so similar techniques may reappear and require further countermeasures.