CRITICAL_STRUCTURE_CORRUPTION (stop code 0x00000109) means Windows caught something red-handed: critical kernel code or data was modified, and the kernel knows it didn’t do it. Think of it as a tamper alarm. The kernel keeps checksums on its most important structures, and when one doesn’t match, it crashes deliberately rather than run on compromised foundations.

The “something” is usually a driver with a memory bug — writing where it shouldn’t and accidentally stomping on kernel structures. But there’s a second, nastier possibility: malware deliberately patching the kernel. That’s why the fix order here starts with a malware scan, not driver updates. Rule out the hostile cause first, then hunt the buggy one.

Why this happens

  • Buggy kernel-level drivers: Antivirus filters, VPN clients, disk encryption tools, and virtualization drivers all run in kernel mode. A buffer bug in any of them can overwrite critical kernel structures.
  • Rootkits and bootkits: Malware that patches the kernel to hide itself trips PatchGuard’s integrity checks, producing exactly this crash. This is one of the few stop codes where malware is a first-line suspect.
  • Failing RAM: Bad memory corrupts kernel structures the same way a buggy driver does — the kernel can’t tell the difference, and neither can you without testing.
  • Corrupt driver files: A half-updated or disk-corrupted driver can misbehave in ways the original never did, including writing to wrong addresses.
  • Overclocked or unstable memory: Marginal RAM timings corrupt kernel data under load, producing intermittent crashes that look like driver problems.
  • Failing storage corrupting loaded drivers: A dying SSD can corrupt driver code as it loads, turning a good driver into a structure-corrupting one.
  • Hypervisor conflicts: Running Hyper-V alongside third-party virtualization or “game booster” drivers that fight over kernel hooks can corrupt shared structures.

How to fix it

Work through these in order — malware scan first, because it’s the one cause that gets worse while you troubleshoot drivers.

Fix 1: Run a Microsoft Defender Offline scan

Rule out rootkits before touching anything else.

  1. Open Windows Security (Win + S, type windows security).
  2. Go to Virus & threat protection > Scan options > Microsoft Defender Offline scan > Scan now.
  3. The laptop reboots into a clean environment outside Windows and scans deeply — this catches rootkits that hide from normal scans.
  4. Remove anything found and restart normally. If the scan finds a bootkit, change your passwords from a clean device afterward.

Fix 2: Remove recently installed kernel-level software

If crashes started after installing something, that something is suspect number one.

  1. Open Settings > Apps > Installed apps and sort by install date.
  2. Look for antivirus suites, VPN clients, disk utilities, “system optimizers,” or virtualization tools installed around when crashes began.
  3. Uninstall the most recent ones — use the vendor’s removal tool if available (Norton, McAfee, and others leave filter drivers behind with normal uninstalls).
  4. Restart and test for a few days before reinstalling anything. Reinstall one at a time so you know which one was guilty.

Fix 3: Update all drivers, starting with storage and chipset

With malware and recent installs addressed, fix the driver layer.

  1. Open Device Manager (Win + X) and update Storage controllers, System devices, and Network adapters.
  2. Get chipset and storage drivers from your laptop manufacturer’s support page — generic Windows drivers for storage controllers are a known source of this crash.
  3. Update graphics drivers from the GPU maker as well, though they’re a less common cause here.
  4. Check Microsoft’s Windows support hub for any known driver conflicts with your current build.

Fix 4: Identify the corrupting driver with Driver Verifier

When you need a name, Driver Verifier forces the guilty driver to crash immediately instead of corrupting silently.

  1. Press Win + R, type verifier, and press Enter.
  2. Choose Create standard settings > Select driver names from a list.
  3. Select third-party (non-Microsoft) drivers — sort by provider and tick the non-Microsoft ones.
  4. Restart. Verifier stresses drivers; the guilty one will blue screen quickly, and the dump will name it.
  5. Important: Turn Verifier off afterward by running verifier /reset in an elevated prompt — leaving it on slows the system and can cause crashes on its own.

Fix 5: Test your RAM

Bad memory is the second most common cause of this stop code.

  1. Press Win + R, type mdsched.exe, press Enter, and choose Restart now and check for problems.
  2. Any error means bad RAM — replace or service it.
  3. Also reset any XMP/overclock profiles to stock in the BIOS while you’re at it; marginal memory timings corrupt kernel structures under load.
  4. If you want the full memory-testing playbook, see how to fix stop code MEMORY_MANAGEMENT .

Fix 6: Repair system files and check the disk

Corruption in the kernel’s own files or the storage beneath them.

  1. In Terminal (Admin), run sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth.
  2. Then run chkdsk C: /f and reboot for the scan.
  3. If chkdsk reports bad sectors on an SSD, check the drive’s health with the manufacturer’s tool — a failing drive corrupting drivers is a real and underdiagnosed cause.

Fix 7: Clean-boot to isolate the conflict

If Verifier didn’t name anyone, bisect the software stack.

  1. Press Win + R, type msconfig, press Enter.
  2. On Services, tick Hide all Microsoft services, then Disable all. Disable all Startup items in Task Manager.
  3. Restart and test. If crashes stop, re-enable in halves until they return.
  4. The last re-enabled group contains your culprit — usually a “helper” utility you forgot was even installed.

Fix 8: Reset Windows

The last resort for a corrupted driver stack.

  1. Back up your files first.
  2. Go to Settings > System > Recovery > Reset this PC > Keep my files.
  3. After the reset, install drivers only from the manufacturer — resist the urge to reinstall every utility you had before, and add them back one at a time.
  4. For general blue screen methodology beyond this code, how to fix the blue screen of death on Windows 11 is a good companion read.

Closing

CRITICAL_STRUCTURE_CORRUPTION is Windows telling you its foundations were tampered with — and the tamperer is usually a kernel driver, occasionally malware, sometimes dying RAM. Scan for the hostile cause first, then strip back recent kernel software, verify with Driver Verifier, and test memory. It’s a methodical hunt, but the crash itself is doing you a favor: it caught the corruption before it could do real damage.

Frequently asked questions

What does CRITICAL_STRUCTURE_CORRUPTION mean?
Windows detected that critical kernel code or data was modified when it shouldn’t have been — something overwrote part of the kernel’s protected structures. The usual culprit is a buggy driver writing to memory it doesn’t own, though bad RAM can produce the same signature.
Is CRITICAL_STRUCTURE_CORRUPTION caused by malware?
It can be. Rootkits modify kernel structures to hide themselves, and Windows’ PatchGuard detects the tampering and crashes with this exact code. If the crashes started after installing sketchy software, run a Microsoft Defender Offline scan before anything else.
Which drivers cause this error most often?
Third-party antivirus filter drivers, VPN clients, disk utilities, and outdated storage drivers top the list. These all operate at kernel level where a bug can scribble over critical structures. Graphics drivers cause it less often than with other stop codes.
Can bad RAM cause CRITICAL_STRUCTURE_CORRUPTION?
Yes. Failing memory corrupts whatever it touches, including kernel structures. If driver updates and malware scans don’t help, test your RAM — memory errors are the second most common cause after bad drivers.