Windows 11 24H2 Update Bug

Microsoft has officially confirmed a major bug in its recent Windows 11 24H2 updates that is causing widespread Blue Screen of Death (BSOD) crashes, displaying the stop error code “SECURE_KERNEL_ERROR” (0x18B).

The issue, first reported by Windows Latest in March 2025, has now escalated following the release of the April 2025 Patch Tuesday update, affecting thousands of users globally.

The BSOD bug impacts the three most recent Windows 11 24H2 updates:

After installing any of these updates and rebooting, affected systems may crash with the “SECURE_KERNEL_ERROR” message, sometimes entering a persistent crash-restart loop or becoming unbootable altogether.

The error points to a failure in the Secure Kernel, a critical component responsible for foundational security and virtualization operations within Windows.

Initial Response and Escalation

When reports first surfaced in March, Microsoft did not immediately acknowledge the issue, as it appeared limited in scope. However, as user complaints surged after the April update, Microsoft quietly updated its support documentation to confirm the bug and began investigating its root cause.

google

Beyond the BSOD, the same updates have triggered additional problems, including:

  • Windows Hello failures: Users are unable to sign in with facial recognition or PIN.
  • Game and software compatibility issues: Notably, ARM-based devices are unable to launch Roblox, and some Citrix software installations fail.

Microsoft has responded with urgency, deploying a Known Issue Rollback (KIR)—a server-side mechanism that remotely disables the problematic code introduced by the updates.

This fix is being automatically pushed to all affected consumer and unmanaged business devices via Windows Update. However, the KIR propagation may take up to 24 hours to reach all systems. Users are advised to:

  • Keep their device connected to the internet
  • Restart their PC multiple times to expedite the fix

“This issue is mitigated using Known Issue Rollback (KIR). Please note that it might take up to 24 hours for the resolution to propagate automatically to consumer devices,” Microsoft stated in its support documentation.

For enterprise and IT-managed environments, administrators must manually deploy a special Group Policy update to roll back the faulty code. The relevant Group Policy can be found under Computer Configuration > Administrative Templates in the Group Policy Editor, as detailed in Microsoft’s official documentation.

While the KIR provides immediate relief, it is only a temporary workaround. Microsoft is actively working on a permanent fix, which is expected to be included in a future Windows update. In the meantime, users are encouraged to check for updates frequently and reboot their systems to ensure the KIR is applied swiftly.

The SECURE_KERNEL_ERROR crisis has disrupted both home and enterprise users, with some reporting repeated crashes and others unable to boot their systems at all. The incident has reignited concerns about the reliability of Windows updates as the company continues to balance rapid security patching with system stability.

Microsoft has also acknowledged related issues—such as Windows Hello failures—and has promised additional fixes in the upcoming May 2025 update.

Summary Table: Affected Updates and Issues

UpdateRelease DateMain IssuesMitigation
KB5053598Mar 11, 2025BSOD (SECURE_KERNEL_ERROR)KIR auto/server-side
KB5053656Mar 27, 2025BSOD, Windows Hello failuresKIR/Group Policy
KB5055523Apr 8, 2025BSOD, Windows Hello, app issuesKIR/Group Policy

What Users Should Do:

  • Restart your PC several times and check for updates to receive the KIR fix faster.
  • For managed devices, IT admins should deploy the KIR Group Policy and restart affected systems.
  • Watch for further updates from Microsoft as a permanent fix is in development.

Microsoft’s rapid response via KIR has helped stem the worst of the disruption, but the incident underscores the ongoing challenges of maintaining stability in a rapidly evolving operating system landscape.

Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!-> Get Your Free Copy

googlenews
Guru Baran
Gurubaran is the Co-Founder and Editor-in-Chief of CyberSecurityNews.com, specializing in vulnerability analysis, malware research, ransomware, and computer forensics.