In protected mode the operating system kernel runs at a higher privilege such as ring 0, and applications at a lower privilege such as ring 3.[citation needed] In software-based virtualization, a host OS has direct access to hardware while the guest OSs have limited access to hardware, just like any other application of the host OS. One approach used in x86 software-based virtualization to overcome this limitation is called ring deprivileging, which involves running the guest OS at a ring higher (lesser privileged) than 0.[2]