How to Fix the KMODE EXCEPTION NOT HANDLED BSOD

In this latest installment of a continuing series that digs into various Windows stop errors or bug checks – also known as BSODs for “Blue Screens of Death” – we delve into the KMODE EXCEPTION NOT HANDLED error. It takes an error code value of 0X0000001E (also written as 0X1E with leading zeros between the X and larger numbers dropped). This particular error is something of a catch-all. In fact, its Microsoft Learn page observes that when this error occurs, it “indicates that a kernel-mode program generated an exception that the error handler didn’t catch.” Thus, it represents a fall-back error handler that signals some kind of unexpected or unplanned-for exception has occurred.

 Windows Kernel-Mode Is Where the OS Action Is

Through no coincidence whatsoever, my go-to reference for Windows internals is an MS Press book with that very name – in this case, Windows Internals, Part 1 (Pavel Yosifovich; Alex Ionescu; Mark E. Russinovich; and David A. Solomon, 7th edition). Kernel mode comes up for discussion early on this book, and I’m summarizing what’s covered there in Chapter 1 in the section entitled “Kernel Mode vs. User Mode”.

Let’s begin with a definition for kernel mode: “……a mode of execution in a processor that grants access to all system memory and all CPU instructions.” Thus kernel mode access provide no-holds-barred, anything-goes control over and access to the run-time environment, the CPU, memory, all attached resources, and so on.  Simply put, this level of access is one that only important and trusted components of the Windows OS may use.

In addition, as the book states further in the same section “the kernel-mode OS and device-driver code share a single virtual address space.” That is, everything runs together inside a single, shared address space with a unified, monolithic view of resources available. This helps explain why drivers pop up often when discussing BSODs: Windows includes thousands of drivers, and each is a potential problem source. When that potential is realized, BSODs can – and often do – occur.

Windows Internals emphasizes “the need to remain vigilant when loading a third-party device driver, especially if it’s unsigned, because once in kernel mode, the driver has complete access to all OS data.” It goes onto explain this as a glaring weakness that impelled Windows 10 to insist on signed Windows drivers (also true for 11) with warnings or blocks emitted whenever users attempt to install unsigned drivers.

Drivers Can Cause KMODE EXCEPTION NOT HANDLED 

Although not all errors that provoke this BSOD are directly or indirectly indicative of a driver problem, most of them relate to device or firmware issues. Thus, when the BSOD labeled as KMODE EXCEPTION NOT HANDLED occurs, it may sometimes be trailed by additional explanatory text. Each such text item points you in a specific direction for further investigation, if and when it occurs:

• Filename (e.g. ntfs.sys, netio.sys, ndis.sys, tcpip.sys, iastora.sys, and so forth). This provides information about the name of some file from which the error originated. It points to system aspects or components where further investigation will help. Ntfs.sys points to the NT File System, and thus to disk drives and file access. Ndis.sys points to the Windows Network Driver Interface Specification and thus to network interfaces and access. TCP/IP is the network protocol of choice on Windows networks and for Internet access. Iastor is part of Intel’s Rapid Storage Technology (RST), often associated with drive arrays or high-end, high speed storage devices.
  
•  Overclock: indicates that failure is related to base, CPU or memory clock rate on a PC (usually appears only on deliberately overclocked systems). Usually best addressed by turning off CPU overclocking, or backing off from current timing levels.
  
• RAM: indicates that a memory fault may be the source of the error. Often requires replacing one or more memory modules to fix.
  
• USB: Could indicate a bad USB driver (which can pop up at the class, controller or device level) or a faulty or failing USB device. Easy to check by unplugging all USB devices except mouse and keyboard. Assuming those are working, plug in other USB devices one at a time until the error recurs.
  
• Not handled during install: Indicates a failure during OS install related to a corrupt or invalid driver that does not work with your PC.
  
• Loop: generally associated with graphics card drivers that won’t load, causing the OS to try and fail to load them repeatedly (in a loop, in the terms of the error text itself). Usually requires replacing the graphics card driver (or occasionally, the graphics card itself). 

Corrupt / Missing Device Drivers Can Cause KMODE EXCEPTION NOT HANDLED 

If drivers are missing, they will show up as Unknown Devices in Device Manager. Because Windows can’t find the drivers itself, you must dig into the Details tab for such devices. You can use the Hardware IDs information (see following screencap) to look up devices and find associated drivers.

Normally, the information surrounding the BSOD will point you to specific devices or drivers. Your best bet is to make an image backup of your system (to which you can always revert if things get worse), and then to replace the existing driver with a known, good working copy of the same version, if a newer version is not available.

On the other hand, if a newer driver doesn’t help – as may be the case on older systems – you may need to install an older driver instead of a newer one. Websites such as Station Drivers maintain archives of drivers that go back 5 or more years. It’s an excellent source for newer drivers than you may find at the OEM site, but also for older drivers that the OEM no longer makes available. 

Network Driver Errors and Fixes for KMODE EXCEPTION NOT HANDLED 

If you get a text string that includes any of the following: netio.sys, ndis.sys, tcpip.sys, and so forth, all of these things point to issues with networking. NDIS is the basis for all network interface drivers, and netio refers to the ability to send and receive data over a network. TCP/IP is the primary networking protocol stack used to send and receive information across Windows networks.

For any and all of these issues, your best bet is to uninstall the current network interface drivers in Device Manager, and then to reboot your PC. During boot-up Windows should manage to find and install the latest (and working) network driver on your behalf. If that doesn’t work, you’ll have to turn to sites like the afore-linked Station Drivers to look for drivers that work on your particular PC (or to vendor sites such as Intel, Broadcomm, Realtek, and so forth). 

Warning: the older your PC, the more interesting and challenging this exercise can get. The short version of this particular fix is: Update network drivers!

Antivirus Conflicts Can Cause KMODE EXCEPTION NOT HANDLED 

Some reports blame specific antivirus programs as culprits in causing BSODs labeled KMODE EXCEPTION NOT HANDLED. If the previous solutions provide no relief, you might try suspending or uninstalling your antivirus software – assuming it’s something other than Windows Defender – to see if that helps. 

If it does help, there’s no longer any reason to avoid Windows Defender as your go-to AV protection. It now rates as high as most third-party commercial packages at such rating sites as AV-Comparatives and Virus Bulletin. 

Still Having Problems? Try the Repair Maneuvers 

If none of the preceding suggestions help your situation (and they should  for 90-plus percent of readers) I recommend running the following commands at the command line: 

DISM /online /cleanup-image /restorehealth 
SFC /Scannow

If those don’t fix things, it’s time to run a repair install of Windows. If you still get no joy, your only remaining option is a clean install of Windows (10 or 11, whatever your version might be) with hopes that this will finally cure your ills.