In this latest installment of a continuing series that digs into various Windows stop errors or bug checks – also known as BSODs for “Blue Screen of Death” – we delve into the KMODE EXCEPTION NOT HANDLED error. It takes an error code value of 0X0000001E (also written as 0X1E with leading zeros between the X and larger numbers dropped). This particular error is something of a catch-all. In fact, its Microsoft Docs page (opens in new tab) observes that when this error occurs, it “indicates that a kernel-mode program generated an exception that the error handler did not catch.” Thus it represents a fall-back error handler that signals some kind of unexpected and unplanned-for exception has occurred.
Windows Kernel-Mode Is Where the OS Action Is
Through no coincidence whatsoever, my go-to reference for Windows internals is an MS Press book with that very name – in this case, Windows Internals, Part 1 (opens in new tab) (Mark Russinovich, David Solomon and Alex Ionescu, 6th edition, 2015). Kernel mode comes up for discussion early on this book, and I’m summarizing what’s covered there on pages 17 through 20.
First, here’s a definition for kernel mode: “…a mode of execution in a processor that grants access to all system memory and all CPU instructions.” In other words, this mode of access provides a no-holds-barred, anything-goes level of access and control over the run-time environment, the CPU, and all attached devices. In short, this is the level of access that only the most important components of the Windows OS enjoy.
Oh, there’s one more important kind of kernel mode resident: “the kernel-mode operating system and device driver code share a single virtual address space.” That is, they run together and share the same address space and resources. This goes a long way to explaining why drivers pop up so often when discussing BSODs: there are thousands of them for Windows, and each one is a potential source of problems. Alas, sometimes that potential gets realized, and BSODs occur.
The book emphasizes the “need to take care when loading a third-party device driver.” Why? Because once it’s loaded, its code has total access to operating system data. The book labels this design explicitly as a “weakness” and observes that it explains the necessity for “the driver-signing mechanism introduced in Windows, which warns…the use if an attempt is made to add an unsigned … driver.”
Drivers Can Cause KMODE EXCEPTION NOT HANDLED
Although not all errors that provoke this BSOD can be directly or indirectly traced back to a driver problem, most of them relate to device or firmware issues. Thus, when the BSOD labeled as KMODE EXCEPTION NOT HANDLED occurs, it may sometimes be trailed by additional explanatory text. Each such text item points you in a specific direction for further investigation, if and when it occurs:
Corrupt / Missing Device Drivers Can Cause KMODE EXCEPTION NOT HANDLED
If drivers are missing, they will show up as Unknown Devices in Device Manager. Because Windows can’t find the drivers itself, you must dig into the Details tab for such devices. You can use the Hardware IDs information (see following screencap) to look up devices and find associated drivers.
Normally, the information surrounding the BSOD will point you to specific devices or drivers. Your best bet is to make an image backup of your system (to which you can always revert if things get worse), and then to replace the existing driver with a known, good working copy of the same version, if a newer version is not available.
On the other hand, if a newer driver doesn’t help – as may be the case on older systems – you may need to install an older driver instead of a newer one. Websites such as Station Drivers maintain archives of drivers that go back 5 or more years. It’s an excellent source for newer drivers than you may find at the OEM site, but also for older drivers that the OEM no longer makes available.
Network Driver Errors and Fixes for KMODE EXCEPTION NOT HANDLED
If you get a text string that includes any of the following: netio.sys, ndis.sys, tcpip.sys, and so forth, all of these things point to issues with networking. NDIS is the basis for all network interface drivers, and netio refers to the ability to send and receive data over. TCP/IP is the primary networking protocol stack used to send and receive information across a network.
For any and all of these issues, your best bet is to uninstall the current network interface drivers in Device Manager, and then to reboot your PC. During boot-up Windows should manage to find and install the latest (and working) network driver on your behalf. If that doesn’t work, you’ll have to turn to sites like the afore-linked Station Drivers to look for drivers that work on your particular PC. Warning: the older your PC, the more interesting and challenging this exercise can become. The short version of this particular fix is: Update network drivers!
Antivirus Conflicts Can Cause KMODE EXCEPTION NOT HANDLED
Some reports blame specific antivirus programs as culprits in causing BSODs labeled KMODE EXCEPTION NOT HANDLED. If the previous solutions provide no relief, you might try suspending or uninstalling your antivirus software – assuming it’s something other than Windows Defender – to see if that helps.
If it does help, there’s no longer any reason to avoid Windows Defender as your go-to AV protection. It now rates as high as most third-party commercial packages at such rating sites as AV-Comparatives and Virus Bulletin.
Still Having Problems? Try the Repair Maneuvers
If none of the preceding suggestions help your situation (and they shouldfor 90-plus percent of readers) I recommend running the following commands at the command line:
DISM /online /cleanup-image /restorehealth SFC /ScannowIf those don’t fix things, it’s time to run a repair install of Windows. If you still get no joy, your only remaining option is a clean install of Windows (10 or 11, whatever your version might be) with hopes that this will finally cure your ills.
Ed TittelEd Tittel is a long-time IT writer, researcher and consultant, and occasional contributor to Tom’s Hardware. A Windows Insider MVP since 2018, he likes to cover OS-related driver, troubleshooting, and security topics.
