KMODE_EXCEPTION_NOT_HANDLED: Kernel Exceptions Demystified for Power Users

Introduction

The Windows stop code KMODE_EXCEPTION_NOT_HANDLED (also shown as KMODE EXCEPTION NOT HANDLED or bug check 0x0000001E) is a classic Blue Screen of Death (BSOD) that signals a serious problem in the Windows kernel. It typically appears during boot, shortly after logging in, or when you start a driver-intensive task (gaming, virtualization, video editing, or connecting new hardware). The error may reference a module such as ntoskrnl.exe or name a specific driver (for example, nvlddmkm.sys, netio.sys, dxgmms2.sys, rt640x64.sys).

It’s critical to fix this issue quickly because repeated KMODE_EXCEPTION_NOT_HANDLED crashes can lead to data loss, corrupted files, and system instability. This guide goes beyond generic advice with structured, step-by-step troubleshooting, advanced diagnostics, and pro tips to resolve the root cause—whether driver, firmware, or hardware.

---

Understanding the Error

At a high level, KMODE_EXCEPTION_NOT_HANDLED means code running in kernel mode (the most privileged part of the OS, where drivers and the Windows kernel operate) threw an exception that wasn’t properly handled. In plain language: a low-level component did something illegal or unexpected, and Windows had to stop to protect your data.

• Bug check code: 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)
• Typical culprits: faulty or incompatible drivers, buggy firmware/BIOS, RAM issues, disk errors, or kernel extensions installed by third-party software (antivirus, VPNs, storage filter drivers).

Common scenarios that trigger this BSOD:

• After a recent Windows Update or driver update.
• Installing or updating graphics, network, or storage drivers.
• Enabling XMP/EXPO memory profiles or CPU overclocking.
• Connecting new USB devices or PCIe cards without proper drivers.
• Corrupt system files or disk integrity issues.
• Old or incompatible low-level software (legacy antivirus, virtual drive, or backup filter drivers).
• Rarely, failing hardware (RAM, SSD/HDD, motherboard).

If the BSOD shows a driver name in parentheses, such as KMODE_EXCEPTION_NOT_HANDLED (dxgmms2.sys), that’s a strong hint toward the problem driver. If it shows only ntoskrnl.exe, that’s typically a byproduct of the crash, not the root cause.

---

Common Causes

Skim this list to focus your troubleshooting:

• Drivers
  • Outdated, buggy, or incompatible GPU, network, Bluetooth, storage (AHCI/RAID/IRST), audio, or USB drivers
  • Residual driver components after a partial uninstall (e.g., old GPU driver, VPN adapters)
• Memory and CPU
  • Unstable RAM (bad sticks, mismatched modules, wrong timings/voltage, XMP/EXPO instability)
  • CPU overclocking or undervolting instability
• Disk and File System
  • File system corruption, bad sectors, failing SSD/HDD, outdated SSD firmware
• BIOS/Firmware
  • Old or buggy BIOS/UEFI, aggressive settings (C-states tweaks, Above 4G Decoding) or XMP/EXPO
• Windows Components
  • Corrupted system files, incomplete updates, component store corruption
• Third-Party Software
  • Low-level antivirus, firewall, VPN, virtual drive, disk encryption, or backup filter drivers
• Malware
  • Kernel-level malware and rootkits interfering with normal driver operations
• Power/Peripherals
  • Faulty USB devices, hubs, docks, or insufficient/unstable PSU power delivery

---

Preliminary Checks

Before deep dives, perform these safer basics to stabilize and preserve data.

• Boot to Safe Mode

  • Windows 10/11:
    • If you can sign in: Hold Shift while clicking Restart → Troubleshoot → Advanced options → Startup Settings → Restart → Press 4 (Safe Mode) or 5 (Safe Mode with Networking).
    • If you can’t sign in (boot loop): Power on and interrupt boot 2–3 times (hold power to force off) to trigger Windows Recovery → Troubleshoot → Advanced options → Startup Settings → Safe Mode.

• Back up important data

  • Use File History, OneDrive, or an external drive. If crashes happen under normal mode, do it from Safe Mode.

• Run basic health checks (from an elevated Command Prompt)

  • System file check:

    sfc /scannow

  • Repair Windows image:

    DISM /Online /Cleanup-Image /RestoreHealth

  • Check disk (online scan of C:):

    chkdsk C: /scan

  • Schedule a full offline check (next reboot):

    chkdsk C: /f /r

  • If any command reports errors that cannot be fixed, note the message and proceed to the troubleshooting steps that target that subsystem.

---

Step-by-Step Troubleshooting

Follow these steps in order. Test for stability between major steps.

1. Undo recent changes

• Unplug newly added USB devices, hubs, docks, and PCIe cards.
• Roll back recent drivers or Windows Updates if the BSOD started right after updating:
  • Settings → Windows Update → Update history → Uninstall updates.
  • Device Manager → Device → Properties → Driver → Roll Back Driver.

2. Cleanly update or reinstall critical drivers

• Prioritize: chipset, storage (AHCI/RAID/Intel RST/AMD RAID), GPU, LAN/Wi-Fi, Bluetooth, audio.
• Download only from:
  • Your PC/motherboard OEM’s support page
  • The device vendor (Intel, AMD, NVIDIA, Realtek)
• For GPU, use a clean reinstall:
  • Uninstall the GPU driver from Apps & features.
  • Optional but recommended: Use DDU (Display Driver Uninstaller) in Safe Mode to remove remnants.
  • Install the latest WHQL driver.
• For storage:
  • If using Intel RST/RAID, ensure the IRST driver matches your chipset and OS.
  • For NVMe SSDs, check for firmware updates using the SSD vendor’s tool.
• Reboot and test.

3. Remove problematic low-level software

• Temporarily uninstall third-party antivirus/firewall, VPN, virtualization, disk encryption, backup, or virtual drive tools (e.g., older versions of Daemon Tools, Acronis filter drivers, legacy VPN clients).
• Reboot and test. You can reinstall later with updated versions if stable.

4. Check and reset BIOS/UEFI settings

• Enter BIOS/UEFI (usually Del, F2, or F10 at boot).
• Load Optimized Defaults.
• Disable CPU and RAM overclocks; turn off XMP/EXPO temporarily.
• If Secure Boot or CSM changes preceded the BSOD, revert those changes.
• Save and reboot. If stability improves, re-introduce settings one at a time.

5. Run memory diagnostics

• Quick test: Windows Memory Diagnostic Tool

  • Press Win+R → type:

    mdsched.exe

  • Choose Restart now and check for problems.

• Prefer thorough testing: MemTest86 (bootable USB, at least 4 passes).

• If errors occur:

  • Test each RAM stick individually and each slot.
  • Reseat modules, match pairs, or reduce speed/timings (avoid XMP/EXPO).
  • Replace faulty RAM.

6. Scan and repair system files and the Windows image

• Run again if you changed drivers or repaired disks:

  sfc /scannow
  DISM /Online /Cleanup-Image /RestoreHealth

• If SFC continues to report unrepaired files, plan for an in-place repair (see step 11).

7. Analyze minidumps to pinpoint drivers or modules

• See “Minidump Analysis” below for detailed steps using WinDbg or BlueScreenView.
• If a driver is repeatedly flagged, update, roll back, or remove it. If it’s a system component like ntfs.sys or tcpip.sys, suspect third-party filter drivers or related hardware.

8. Check disk health and firmware

• Review SMART health using your SSD/HDD vendor’s tool or PowerShell:

  • PowerShell (admin):

    Get-PhysicalDisk | Get-StorageHealthReport

  • Or vendor tools (Samsung Magician, Crucial Storage Executive, WD Dashboard).

• If SMART shows warnings or reallocated sectors, consider replacing the drive.

• Update SSD firmware and motherboard storage controller drivers.

9. Use System Restore or rollback features

• If the error started recently:
  • Control Panel → Recovery → Open System Restore → choose a restore point prior to the issue.
• Alternatively, roll back using Settings → System → Recovery → Go back (if available after a feature update).

10. BIOS/UEFI update

• Check your motherboard/OEM page for a newer BIOS/UEFI with stability fixes.
• Follow the vendor’s update instructions precisely. Avoid interrupting power during flashing.
• After update, load defaults and retest. Re-enable specific features cautiously.

11. In-place repair upgrade (keeps files and apps)

• Use the official Windows 10/11 Media Creation Tool or Windows 11 Installation Assistant.
• Launch setup from within Windows → Upgrade this PC now → Keep personal files and apps.
• This replaces system files and refreshes components while preserving data.

12. Last resort: clean installation

• Back up data fully.
• Create installation media via Media Creation Tool.
• Delete system partitions during setup and install fresh.
• Install chipset/storage drivers first, then GPU, networking, audio. Test after each major driver.

---

Minidump Analysis (within the troubleshooting flow)

The single most effective way to resolve a recurring KMODE_EXCEPTION_NOT_HANDLED is to identify the offending driver via crash dumps.

• Enable small memory dumps

  • Press Win+R → type:

    sysdm.cpl

  • Advanced tab → Startup and Recovery → Settings

  • Under “Write debugging information,” choose Small memory dump (256 KB)

  • Dump file: %SystemRoot%\Minidump (C:\Windows\Minidump)

  • Ensure “Automatically restart” is unchecked so you can read BSOD details.

• Locate minidumps

  • Path: C:\Windows\Minidump
  • Files: .dmp with timestamps

• Option A: Use BlueScreenView (easier)

  • Install BlueScreenView by NirSoft.
  • Open the app → it auto-loads dumps.
  • Check “Caused By Driver” and the stack list. Note any recurring driver (e.g., nvlddmkm.sys, rt640x64.sys, aswSP.sys for Avast).
  • Action: Update/roll back/uninstall the flagged driver/software.

• Option B: Use WinDbg (more precise)

  • Install WinDbg (Preview) from Microsoft Store or Windows SDK.

  • Launch WinDbg (Preview) → File → Open dump file → select latest .dmp.

  • Set the symbol path (if prompted):

    srvC:\Symbolshttps://msdl.microsoft.com/download/symbols

  • Run:

    !analyze -v

  • Look at:

    • BugCheck code (should be 0x1E)
    • “Probably caused by” line
    • Faulting module and stack trace

  • Inspect a suspect driver:

    lmvm drivername

    Replace drivername with the module (e.g., nvlddmkm).

  • If a Microsoft system file is shown, the true cause is often a third-party filter or hardware. Cross-check with Event Viewer and Driver Verifier.

Pro tips:

• Correlations matter. One-off “probable cause” lines can mislead. Look for patterns across multiple dumps.
• If dumps reference memory corruption, prioritize RAM testing and Driver Verifier.

---

Advanced Diagnostics

Use these when basics don’t isolate the root cause.

• Driver Verifier (exercise caution)

  • Purpose: stress-tests non-Microsoft drivers to force them to fail fast if faulty.

  • Note: It can cause additional BSODs by design. Back up data and enable minidumps first.

  • Steps (elevated Command Prompt):

    verifier

    • Create custom settings (for code developers) → Select individual settings → Check:
      • I/O verification
      • Force pending I/O requests
      • IRQL checking
      • Pool tracking
      • Deadlock detection
      • DMA checking
      • Security checks
      • Miscellaneous checks
    • Select driver names from a list → check all non-Microsoft drivers.
    • Reboot and use the PC normally until it crashes.

  • After a crash, analyze the new dump; it often names the culprit directly.

  • Disable Driver Verifier when done:

    verifier /reset

    Reboot.

• Event Viewer and Reliability Monitor

  • Event Viewer: Windows Logs → System → Filter current log…
    • Sources: “BugCheck”, “DistributedCOM”, “disk”, “storahci”, “nvlddmkm”, “ACPI”, “WHEA-Logger”
    • Look for errors around the time of the BSOD.
  • Reliability Monitor: Search “View reliability history”.
    • Shows a timeline of critical events, app crashes, and driver installs.

• Power and thermal checks

  • Use HWInfo or Open Hardware Monitor to verify temps and voltages.
  • Ensure PSU is adequate and stable, connectors fully seated, and VRM cooling sufficient.

• Peripheral isolation

  • Boot with only essentials: motherboard, CPU, one RAM stick, system drive, GPU (if no iGPU), and keyboard/mouse.
  • Add devices back one at a time to identify the trigger.

• Storage controller mode consistency

  • Switching between AHCI/RAID without proper drivers can cause kernel exceptions.
  • If you changed SATA/NVMe mode, revert or ensure matching drivers are installed.

---

When to Seek Professional Help

Consider contacting a professional or the device manufacturer when:

• MemTest86 shows RAM errors even after reseating and testing modules individually.
• SSD/HDD SMART indicates impending failure or frequent uncorrectable errors.
• BSODs persist after clean installing Windows and using only vendor-provided drivers.
• Multiple different bug checks occur (e.g., 0x1E, 0x50, 0xA, 0xC4) pointing to hardware instability.
• You suspect motherboard, CPU, or PSU issues and lack spare parts to swap-test.

A repair shop can perform extended hardware diagnostics, bench tests, and component substitutions to pinpoint failures.

---

Prevention Tips

• Practice driver hygiene

  • Prefer OEM and vendor drivers over generic driver packs.
  • Update chipset, storage, GPU, and network drivers periodically—but avoid day-one beta drivers on mission-critical machines.
  • Use DDU for clean GPU transitions.

• Keep firmware current

  • Update BIOS/UEFI and SSD firmware when stability or security updates are released.

• Stabilize memory and CPU

  • If you enable XMP/EXPO, verify stability with stress tests. Avoid undervolting/overclocking on production systems.

• Protect the OS

  • Keep Windows Update current; apply quality updates.
  • Create System Restore Points before big changes.
  • Maintain a reliable backup (File History, image backups with VSS-aware tools).

• Be cautious with low-level software

  • Choose reputable antivirus and VPN clients.
  • Avoid legacy virtual drive or filter driver software without recent updates.

• Monitor health

  • Check Reliability Monitor monthly.

  • Periodically run:

    sfc /scannow
    DISM /Online /Cleanup-Image /RestoreHealth
    chkdsk C: /scan

---

Conclusion

The KMODE_EXCEPTION_NOT_HANDLED stop code (0x0000001E) usually traces back to a faulty driver, unstable memory/firmware settings, or storage issues. Start with Safe Mode and backups, then work through driver updates and removals, system and disk checks, minidump analysis, and RAM diagnostics. If needed, reset BIOS/UEFI, update firmware, or perform an in-place repair. With a methodical approach, most KMODE EXCEPTION NOT HANDLED BSODs are fixable.

Stay patient, take notes after each change, and lean on WinDbg, BlueScreenView, Driver Verifier, and Reliability Monitor to gather evidence. You’ve got this—and if the issue persists after a clean install with minimal drivers, don’t hesitate to involve a professional to rule out hardware.

---

FAQ Section

Can I ignore the KMODE_EXCEPTION_NOT_HANDLED BSOD?

No. Repeated kernel exceptions indicate an underlying driver or hardware problem. Ignoring it risks data loss and further corruption. Follow the troubleshooting steps to identify and resolve the cause.

Does this BSOD mean my hardware is failing?

Not necessarily. Many cases are driver-related. However, if RAM tests fail, SMART shows disk issues, or crashes persist after a clean OS install with known-good drivers, hardware may be at fault.

The BSOD shows ntoskrnl.exe—Is Windows itself to blame?

Usually not. ntoskrnl.exe often appears because it’s part of the kernel and involved in the crash, but third-party drivers or hardware faults are more commonly responsible. Use minidump analysis and Driver Verifier to find the real culprit.

I get KMODE EXCEPTION NOT HANDLED with a driver name in parentheses. What should I do?

Update, roll back, or remove the driver named (e.g., dxgmms2.sys, nvlddmkm.sys, rt640x64.sys). If updating doesn’t help, clean reinstall the driver (use DDU for GPU), and check related hardware (GPU, NIC, etc.). Also examine recent software that might have added filter drivers.

Will an in-place repair or clean install definitely fix it?

An in-place repair often fixes OS-level corruption and bad components. A clean install eliminates software causes. If BSODs continue after a clean install with only essential drivers, suspect hardware and consult a professional.