Epic's Easy Anti-Cheat Linux v2 Needs Eight Boot-Security Features and Cannot Yet Run on the Steam Deck

Epic Games' Easy Anti-Cheat Linux v2 will refuse to protect a game unless the machine boots a signed kernel under Secure Boot with a TPM 2.0, and a key you enrolled yourself does not count. Epic announced the design on October 14 and will test it in Fortnite before offering it to other developers. It gave no release date.

This account rests on three outlets' reading of Epic's announcement: XenoSpectrum, The FPS Review and Linuxiac. Epic's own post sits behind a login redirect for readers who are not signed in, so the requirement wording below is theirs, not a transcription of Epic's page.

The eight requirements in Easy Anti-Cheat Linux v2

Easy Anti-Cheat has supported native Linux games since 2014 and Wine and Proton games since 2021, but XenoSpectrum reports that developers held back because Linux protection did not match Windows. Epic's answer, per XenoSpectrum, is that v2 "does not install or load an anti-cheat kernel module."

Requirement	What it checks
Signed kernel and modules	Built by an organisation, signed with a key Epic recognises
Secure Boot	Enabled, booting with a recognised key
TPM 2.0	Enabled in firmware
Measured boot	Records executed code and configuration
IOMMU	Enabled with passthrough off (non-handheld devices only)
Kernel lockdown	Integrity mode set at boot
kexec	Disabled at boot
BPF LSM	Loaded and enabled

The grouping is XenoSpectrum's own: signatures, a boot record in the TPM, and limits on changes after boot. Epic says the list may change.

How the check runs

On first launch of a protected game, the player is asked to install a systemd service that runs only while the game does. It loads Epic's eBPF programs, and XenoSpectrum says Epic's BPF LSM will restrict other processes from reading or writing the game's memory. A machine that fails the checks gets an error, not an account suspension, according to both XenoSpectrum and The FPS Review.

The design leans on the boot chain rather than on a driver watching the game. Secure Boot verifies code as it loads, the TPM records what actually booted, and disabling kexec stops a second kernel being swapped in after that record is made.

Whose signing keys count

Epic will maintain the list of recognised keys at first and plans to open-source it, per XenoSpectrum. The three outlets disagree on what is on it today.

XenoSpectrum names Canonical, Fedora and Universal Blue. The FPS Review adds Debian, openSUSE and SUSE, Rocky Linux and the Microsoft UEFI CA. Linuxiac lists Ubuntu, Debian, Fedora, openSUSE, Bazzite, Rocky Linux and AlmaLinux. Check Epic's page for the current list.

The rule that will catch most hobbyists is in The FPS Review: every enrolled Machine Owner Key must be recognised, so a self-enrolled key, common on Fedora for locally built NVIDIA modules, fails the check while it is enrolled. Out-of-tree modules such as the NVIDIA driver must be built by an organisation and signed with a recognised key. Epic suggests a separate boot entry for protected games.

The Steam Deck and what is not shown

The Steam Deck lacks features v2 needs, and Epic says it is talking to Valve. The IOMMU item exempts handhelds, but the other seven still apply. No outlet says which features the Deck is missing.

None of the three reports contains measured results. XenoSpectrum notes that no figures show how much cheating v2 stops, and that the design does not address which specific cheats it blocks or misses beyond the IOMMU entry for cheating hardware. A signed-boot attestation proves the machine started in an approved state; it does not prove the game's memory is clean afterwards, much as Mark of the Web on Windows only works until something strips it.

Games that already use the Linux version of EAC can stay on it. Distributions that want their key listed are asked to meet the configuration requirements and approach Epic. Anyone running a custom kernel, including the kernel branches developers build for testing, should expect to be outside the list until Epic publishes it.