System file and kernel errors

CRITICAL_STRUCTURE_CORRUPTION (0x00000109)

Stop code 0x00000109, also written 0x109. Here is what it means, what usually causes it, and the safest order to work through fixes on Windows 11 and Windows 10.

In short

Windows detected that critical kernel code or data was changed. A driver, unstable memory or settings that corrupt memory are the usual places to look.

What CRITICAL_STRUCTURE_CORRUPTION means

Bug check 0x109 means the kernel detected corruption of critical kernel code or data. Microsoft lists three causes: a driver modifying kernel code or data, a kernel breakpoint set without a debugger attached, and hardware corruption such as kernel code or data held in failing memory. The fourth parameter says which kind of structure was damaged, which is why two crashes with this code can have different causes.

Common causes

A driver or low-level tool that modifies protected kernel code or data
Faulty RAM or memory settings that are not stable
Recently installed or updated drivers, particularly for security, overclocking or monitoring software
A debugging tool or breakpoint left active without a debugger attached

How to fix CRITICAL_STRUCTURE_CORRUPTION

Work through these in order and test after each one. Stopping as soon as the crashes stop tells you which change mattered.

Check Event Viewer for the device or driver involved. Open Event Viewer, then Windows Logs, System, and look for errors close to each crash that identify a device or driver.
Undo the most recent change. If the blue screens began after a Windows update, a new driver or new software, remove that change first. Uninstall the update from Settings, Windows Update, Update history, or roll a driver back in Device Manager (right-click the device, Properties, Driver, Roll Back Driver).
Note the file name on the blue screen. If the screen shows a line such as "What failed" followed by a .sys file, write it down. Searching that file name shows which driver it belongs to, which tells you what to update or remove. The named file is the code that crashed, which is not always the root cause.
Return the PC to stock settings. Reset the BIOS to defaults, then leave XMP or EXPO, CPU or GPU overclocks and undervolts (including per-core offsets such as Curve Optimizer) switched off while you test. If the crashes stop, re-enable one setting at a time to find the unstable one.
Test the memory. Run Windows Memory Diagnostic (search for it in Start) for a quick check, then MemTest86 for several passes if the crashes continue. Any error points to a faulty stick or slot, or to memory settings the hardware cannot run reliably.
Run the maker’s hardware diagnostics. Many PC and laptop makers include a hardware test in the BIOS or boot menu or as a downloadable tool. Run the memory and drive tests it offers, and confirm any new hardware is compatible with your version of Windows.

Reading the crash evidence for 0x109

Microsoft’s reference says the first three parameters are reserved and the fourth identifies the type of the corrupted region. That one value is the key to the crash: it tells a debugger whether kernel code, a table, a list or a driver object was changed.

Hardware is a documented cause as well as software. Microsoft’s basic troubleshooting for this code includes checking Event Viewer, disabling or updating a named driver, running Windows Memory Diagnostic and running the manufacturer’s hardware diagnostics.

Some fourth-parameter values for 0x109 documented by Microsoft
Fourth parameter	What Microsoft describes	What it suggests
0x0	A generic data region	Corruption of protected data
0x1	A function modification	Something altered kernel code
0x2	A processor interrupt dispatch table (IDT)	Something altered a core CPU table
0x19	Modification of the loaded module list	A driver or tool altered kernel structures
0x1C	Driver object corruption	A driver’s own data was damaged
0x27, 0x28 or 0x29	Type 1, 2 or 3 pool corruption	Memory pool damage, often by a driver
0x101	General pool corruption	Memory pool damage
0x102	Modification of win32k.sys	Alteration of a core graphics component

Source: Microsoft Learn: Bug Check 0x109 CRITICAL_STRUCTURE_CORRUPTION ↗

When to stop and protect your data

If memory tests and maker diagnostics fail, replace the part that reports the fault. If everything passes and the crashes continue, keep the minidump for a debugger-informed diagnosis before reinstalling Windows.

Not sure this is your code?

The stop code appears as text on the blue screen. If the PC restarted before you could read it, open Event Viewer, then Windows Logs, then System, and look for a BugCheck event with ID 1001. You can also search all stop codes.

Related guides

Other system file and kernel errors

Frequently asked questions

What does CRITICAL_STRUCTURE_CORRUPTION mean?

Windows detected that critical kernel code or data was changed. A driver, unstable memory or settings that corrupt memory are the usual places to look. Bug check 0x109 means the kernel detected corruption of critical kernel code or data. Microsoft lists three causes: a driver modifying kernel code or data, a kernel breakpoint set without a debugger attached, and hardware corruption such as kernel code or data held in failing memory. The fourth parameter says which kind of structure was damaged, which is why two crashes with this code can have different causes.

What usually causes CRITICAL_STRUCTURE_CORRUPTION?

Typical causes: A driver or low-level tool that modifies protected kernel code or data; Faulty RAM or memory settings that are not stable; Recently installed or updated drivers, particularly for security, overclocking or monitoring software; A debugging tool or breakpoint left active without a debugger attached.

How do I fix CRITICAL_STRUCTURE_CORRUPTION (0x00000109)?

A sensible order is: 1) Check Event Viewer for the device or driver involved; 2) Undo the most recent change; 3) Note the file name on the blue screen; 4) Return the PC to stock settings. If memory tests and maker diagnostics fail, replace the part that reports the fault. If everything passes and the crashes continue, keep the minidump for a debugger-informed diagnosis before reinstalling Windows.

Is CRITICAL_STRUCTURE_CORRUPTION caused by malware?

The stop code means kernel code or data was changed, and Microsoft attributes that to drivers, debugging tools or hardware corruption rather than naming malware. If you see other signs of infection, run a full Microsoft Defender scan.

How is 0x109 different from 0x139?

Both involve corruption, but KERNEL_SECURITY_CHECK_FAILURE (0x139) reports a damaged critical data structure caught by a runtime check, while 0x109 reports that critical kernel code or data was modified, with its fourth parameter naming what changed.

Use this guidance carefully

A stop code can have several causes, and these steps are general guidance rather than a diagnosis of your PC. If your data matters, back it up before repairs. If the problem continues, a hardware technician can test the parts.

See our testing methodology·Read our editorial policy