◆Error Codes Wiki

Windows ntoskrnl.exe BSOD — Kernel Crash Analysis

Criticalbsod

Overview

When ntoskrnl.exe appears as the faulting module in a BSOD, it indicates a Windows kernel crash typically caused by faulty drivers, bad RAM, or disk corruption.

Key Details

  • ntoskrnl.exe is the Windows NT operating system kernel — the core of Windows
  • When ntoskrnl.exe is the faulting module, it rarely means the kernel itself is buggy
  • Usually another driver corrupted kernel memory, and ntoskrnl.exe detected the corruption
  • Common stop codes naming ntoskrnl.exe: SYSTEM_SERVICE_EXCEPTION, KERNEL_SECURITY_CHECK_FAILURE
  • Minidump analysis is essential to find the real culprit behind the kernel crash

Common Causes

  • Third-party driver corrupting kernel memory (ntoskrnl detects the corruption, not causes it)
  • Faulty RAM causing random kernel memory corruption
  • Overclocked CPU producing calculation errors in kernel code
  • Corrupted Windows system files
  • Storage driver issue causing kernel data read/write errors

Steps

  1. 1Analyze the minidump with WinDbg: !analyze -v to find the real faulting driver
  2. 2Run MemTest86 for at least 4 passes to thoroughly test RAM
  3. 3Reset CPU and RAM overclock to stock settings
  4. 4Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth
  5. 5Update all drivers, especially storage, network, and GPU drivers

Tags

windowsntoskrnlkernelbsodcrash-analysis

More in Bsod

windows-0000000A-irql-not-less-or-equalWindows Error 0x0000000A — IRQL NOT LESS OR EQUAL
Critical
windows-00000050-page-fault-in-nonpaged-areaWindows Error 0x00000050 — PAGE FAULT IN NONPAGED AREA
Critical
windows-0000007E-system-thread-exception-not-handledWindows Error 0x0000007E — SYSTEM THREAD EXCEPTION NOT HANDLED
Critical
windows-0000007A-kernel-data-inpage-errorWindows Error 0x0000007A — KERNEL DATA INPAGE ERROR
Critical
windows-000000EF-critical-process-diedWindows Error 0x000000EF — CRITICAL PROCESS DIED
Critical
windows-00000133-dpc-watchdog-violationWindows Error 0x00000133 — DPC WATCHDOG VIOLATION
Critical

Frequently Asked Questions

No. ntoskrnl.exe is the kernel — it detects corruption caused by other drivers or hardware. It is the victim, not the cause.