In this latest installment of a continuing series that digs into various Windows stop errors or bug checks – also known asBSODsfor “Blue Screens of Death” – we delve into the KMODE EXCEPTION NOT HANDLED error. It takes an error code value of 0X0000001E (also written as 0X1E with leading zeros between the X and larger numbers dropped). This particular error is something of a catch-all. In fact, itsMicrosoft Learn pageobserves that when this error occurs, it “indicates that a kernel-mode program generated an exception that the error handler didn’t catch.” Thus, it represents a fall-back error handler that signals some kind of unexpected or unplanned-for exception has occurred.
Windows Kernel-Mode Is Where the OS Action Is
Through no coincidence whatsoever, my go-to reference for Windows internals is an MS Press book with that very name – in this case,Windows Internals, Part 1(Pavel Yosifovich; Alex Ionescu; Mark E. Russinovich; and David A. Solomon, 7th edition). Kernel mode comes up for discussion early on this book, and I’m summarizing what’s covered there in Chapter 1 in the section entitled “Kernel Mode vs. User Mode”.
Let’s begin with a definition forkernel mode: “……a mode of execution in a processor that grants access to all system memory and all CPU instructions.” Thus kernel mode access provide no-holds-barred, anything-goes control over and access to the run-time environment, the CPU, memory, all attached resources, and so on. Simply put, this level of access is one that only important and trusted components of the Windows OS may use.
In addition, as the book states further in the same section “the kernel-mode OS and device-driver code share a single virtual address space.” That is, everything runs together inside a single, shared address space with a unified, monolithic view of resources available. This helps explain why drivers pop up often when discussing BSODs: Windows includes thousands of drivers, and each is a potential problem source. When that potential is realized, BSODs can – and often do – occur.
Windows Internalsemphasizes “the need to remain vigilant when loading a third-party device driver, especially if it’s unsigned, because once in kernel mode, the driver has complete access to all OS data.” It goes onto explain this as a glaring weakness that impelled Windows 10 to insist on signed Windows drivers (also true for 11) with warnings or blocks emitted whenever users attempt to install unsigned drivers.
Drivers Can Cause KMODE EXCEPTION NOT HANDLED
Although not all errors that provoke this BSOD are directly or indirectly indicative of a driver problem, most of them relate to device or firmware issues. Thus, when the BSOD labeled as KMODE EXCEPTION NOT HANDLED occurs, it may sometimes be trailed by additional explanatory text. Each such text item points you in a specific direction for further investigation, if and when it occurs:
Corrupt / Missing Device Drivers Can Cause KMODE EXCEPTION NOT HANDLED
If drivers are missing, they will show up as Unknown Devices in Device Manager. Because Windows can’t find the drivers itself, you must dig into the Details tab for such devices. You can use the Hardware IDs information (see following screencap) to look up devices and find associated drivers.
Get Tom’s Hardware’s best news and in-depth reviews, straight to your inbox.
Normally, the information surrounding the BSOD will point you to specific devices or drivers. Your best bet is to make an image backup of your system (to which you can always revert if things get worse), and then to replace the existing driver with a known, good working copy of the same version, if a newer version is not available.
On the other hand, if a newer driver doesn’t help – as may be the case on older systems – you may need to install an older driver instead of a newer one. Websites such asStation Driversmaintain archives of drivers that go back 5 or more years. It’s an excellent source for newer drivers than you may find at the OEM site, but also for older drivers that the OEM no longer makes available.
Network Driver Errors and Fixes for KMODE EXCEPTION NOT HANDLED
If you get a text string that includes any of the following: netio.sys, ndis.sys, tcpip.sys, and so forth, all of these things point to issues with networking. NDIS is the basis for all network interface drivers, and netio refers to the ability to send and receive data over a network. TCP/IP is the primary networking protocol stack used to send and receive information across Windows networks.
For any and all of these issues, your best bet is to uninstall the current network interface drivers in Device Manager, and then to reboot your PC. During boot-up Windows should manage to find and install the latest (and working) network driver on your behalf. If that doesn’t work, you’ll have to turn to sites like the afore-linked Station Drivers to look for drivers that work on your particular PC (or to vendor sites such as Intel, Broadcomm, Realtek, and so forth).
Warning:the older your PC, the more interesting and challenging this exercise can get. The short version of this particular fix is: Update network drivers!
Antivirus Conflicts Can Cause KMODE EXCEPTION NOT HANDLED
Some reports blame specific antivirus programs as culprits in causing BSODs labeled KMODE EXCEPTION NOT HANDLED. If the previous solutions provide no relief, you might try suspending or uninstalling your antivirus software – assuming it’s something other than Windows Defender – to see if that helps.
If it does help, there’s no longer any reason to avoid Windows Defender as your go-to AV protection. It now rates as high as most third-party commercial packages at such rating sites asAV-ComparativesandVirus Bulletin.
Still Having Problems? Try the Repair Maneuvers
If none of the preceding suggestions help your situation (and they should for 90-plus percent of readers) I recommend running the following commands at the command line:
If those don’t fix things, it’s time to run arepair install of Windows. If you still get no joy, your only remaining option is a clean install of Windows (10 or 11, whatever your version might be) with hopes that this will finally cure your ills.
Ed Tittel is a long-time IT writer, researcher and consultant, and occasional contributor to Tom’s Hardware. A Windows Insider MVP since 2018, he likes to cover OS-related driver, troubleshooting, and security topics.
