Software architecture in which a driver operates at the most privileged level of the operating system, where a failure causes an immediate and unrecoverable system halt.
Kernel mode is the most privileged execution level of an operating system such as Windows. A driver or process running in kernel mode has direct, unrestricted access to all physical memory and hardware resources. This maximum privilege grants superior efficiency for endpoint security software, enabling it to intercept malicious system calls before execution, detect rootkits, and guarantee that the protection process cannot be killed by user-space malware. The counterpart is the complete absence of protection against internal errors: if a kernel-mode driver raises an unhandled exception, the operating system has no isolation mechanism. Windows then triggers an emergency halt accompanied by a Blue Screen of Death (BSoD), generates a diagnostic memory dump, and reboots. In the July 2024 CrowdStrike incident, this mechanism turned a logic error in a configuration file into an infinite reboot loop on 8.5 million machines. The eBPF architectural alternative, standard on Linux and advocated since that incident for Windows, allows kernel behavior to be observed from a sandboxed environment without risking this type of collapse.
On 19 July 2024, CrowdStrike Falcon's Channel File 291 contained a logic error in an inter-process communication rule definition. The kernel driver, reading an invalid memory zone, triggered an unhandled exception. Result: an endless BSoD loop on all Windows machines that had downloaded the update, paralyzing hospitals, airports and trading floors worldwide in under 78 minutes.
kernel mode, BSoD, Blue Screen of Death, BSOD, écran bleu