CachyOS, the Arch-based distro a lot of Linux gamers run for its tuned kernels, is building a separate kernel called linux-cachyos-eac for Epic's new Linux anti-cheat. It lives in pull request #1084 on GitHub, opened by lead developer Peter Jung on October 17, and the thread grew to 31 comments on October 27-28. The kernel is opt-in, so regular CachyOS stays as it is. What it costs is already clear: no hibernation and no out-of-tree modules of your own while you boot it. It has not been merged.
Read next:
Eight Epic requirements and zero kernel modules
Epic announced EAC Linux v2 on October 14. Fortnite, which still has no Linux version, gets it first, and other studios follow once Epic is happy with it. There is no anti-cheat kernel driver. Instead a systemd service and eBPF programs run only while a protected game is open. In exchange, the system has to pass a check:
- A signed kernel and signed modules, using a key on Epic's well-known list. A self-built kernel will not pass.
- TPM 2.0, Secure Boot and measured boot, all enabled in firmware.
- IOMMU on, passthrough mode off. Handhelds are exempt from this one.
- Lockdown in integrity mode, kexec disabled, BPF LSM loaded, all set on the kernel command line.
The key list has eight certificate authorities: Canonical, Fedora, Debian, openSUSE, SUSE, Rocky Linux, AlmaLinux and the Microsoft UEFI CA. Nothing from the Arch family. Launch a protected game on a system that fails the check and you get an error message, not a ban; Epic says so in plain words. The Steam Deck does not meet the requirements either, and Epic says it is talking to Valve.
How CachyOS plans to get onto Epic's list
Jung laid out the setup on October 28. CachyOS gets an offline root CA and will ask Epic to add it to the list. A separate signing key, kept on a YubiKey, signs exactly two things: systemd-boot and the linux-cachyos-eac kernel. Kernel modules get a fresh key generated for every build, and MOKs are not trusted for loading modules. Users enroll the CachyOS CA into the Secure Boot database with sbctl, next to their own keys and Microsoft's. A step-by-step guide is being written for the project wiki.
Jung calls this the short-term route. No shim for now; a proper shim-review is planned later. When Foxboron, who wrote sbctl, asked how vulnerable bootloader builds would get revoked, the answer was that there is no plan for that yet. Foxboron calls the whole approach security theater. I lean his way on this one, even though I would also like Fortnite on my Linux box.
What breaks, and what CachyOS promises to keep
One of the first comments in the thread lists what lockdown takes away: hibernation, kdump, PCI passthrough to a VM, some kernel parameters and possibly sched-ext schedulers. Your own DKMS modules will not load either. Jung promised that NVIDIA drivers (Pascal included), ZFS and the r8125 network driver will work out of the box, and widely used drivers can be added on request. OpenRazer and VirtualBox will not get exceptions. GRUB has not been tested yet, only systemd-boot.
The EAC kernel installs next to your normal one. Epic itself suggests keeping a separate boot entry for protected games and using whatever you like the rest of the time. A project contributor says CachyOS Hello will get a button to install it. No date yet, and the pull request is still open.
Sources
CachyOS, pull request #1084 "linux-cachyos-eac: add" on GitHub: opened 17 Oct 2026, discussion 27-28 Oct 2026, not merged as of 29 Oct 2026. Secure Boot guide for the CachyOS wiki, pull request #650. Epic Online Services, "Awesome Gaming on Linux Without Cheating", 14 Oct 2026: EAC Linux v2 requirements, key list and the Steam Deck answer. TechPowerUp, 28 Oct 2026. Images: official Fortnite screenshots from the Epic Games Store, desktop screenshot from the CachyOS website, FramesGames diagram based on the GitHub discussion.
