如何修复KERNEL_SECURITY_CHECK_FAILURE (139)

Question

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffcd854b117770, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffcd854b1176c8, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 3530

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 5217

    Key  : Analysis.Init.CPU.mSec
    Value: 5453

    Key  : Analysis.Init.Elapsed.mSec
    Value: 36515

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 94

    Key  : FailFast.Name
    Value: CORRUPT_LIST_ENTRY

    Key  : FailFast.Type
    Value: 3


FILE_IN_CAB:  081323-10750-01.dmp

DUMP_FILE_ATTRIBUTES: 0x1008
  Kernel Generated Triage Dump

BUGCHECK_CODE:  139

BUGCHECK_P1: 3

BUGCHECK_P2: ffffcd854b117770

BUGCHECK_P3: ffffcd854b1176c8

BUGCHECK_P4: 0

TRAP_FRAME:  ffffcd854b117770 -- (.trap 0xffffcd854b117770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff97861fadb3e8 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff97861f75c158 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8031536bce6 rsp=ffffcd854b117900 rbp=ffff9786209101c0
 r8=0000000000000000  r9=0000000000000000 r10=fffff803157ebf00
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!KeReleaseSemaphore+0x136:
fffff803`1536bce6 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffffcd854b1176c8 -- (.exr 0xffffcd854b1176c8)
ExceptionAddress: fffff8031536bce6 (nt!KeReleaseSemaphore+0x0000000000000136)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY 

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  Calabiyau-Win6

ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

EXCEPTION_STR:  0xc0000409

STACK_TEXT:  
ffffcd85`4b117448 fffff803`154468a9     : 00000000`00000139 00000000`00000003 ffffcd85`4b117770 ffffcd85`4b1176c8 : nt!KeBugCheckEx
ffffcd85`4b117450 fffff803`15446e32     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffcd85`4b117590 fffff803`15444c06     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xb2
ffffcd85`4b117770 fffff803`1536bce6     : ffff9786`1fadb3e0 ffff9786`00000000 ffff9786`1f7631c0 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x346
ffffcd85`4b117900 fffff803`157ec04b     : 00000000`00000000 00000000`00000000 ffffcd85`4b117a60 ffff9786`1fadb3e0 : nt!KeReleaseSemaphore+0x136
ffffcd85`4b117980 fffff803`15445fe5     : ffff9786`1fc69080 00000000`3e2702b0 00000000`00000000 00000000`00000001 : nt!NtReleaseSemaphore+0x9b
ffffcd85`4b1179e0 00007ffe`0a5eee94     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`712dfe08 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`0a5eee94


SYMBOL_NAME:  nt!KiFastFailDispatch+b2

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.22621.2134

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  b2

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {3aede96a-54dd-40d6-d4cb-2a161a843851}

Followup:     MachineOwner
---------

Answer 1

Hello,

Under what circumstances does this error occur? Have you added hardware or updated device drivers?

KERNEL_SECURITY_CHECK_FAILURE (139) indicates that the kernel has detected corruption of critical data structures. It is known that LIST_ENTRY is corrupted through parameter 1. Determining the cause of this problem usually requires using a debugger to gather additional information. Multiple dump files should be examined to see if this stop code has similar characteristics, such as code that was running when the stop code occurred.

You can also try some general troubleshooting that might help:

1. If you recently added hardware to your system, try removing or replacing it.
2. If new device drivers or system services have been added recently, try removing or updating them.
3. Check the system log in Event Viewer for additional error messages that may help pinpoint the device or driver causing the error.
4. Look in Device Manager to see if any devices are marked with an exclamation point (!).
5. Run the virus detection program

In addition, if there are Calabiyau-related applications on the computer, try to update or uninstall them.