Windows BSOD 0x000000CB — DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS Fix

What Does This Error Mean?

Blue screen 0x000000CB (DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS) means a device driver locked memory pages for an I/O operation and then failed to unlock them before the process ended. This is a driver programming error — the driver made a request, the process finished, but the driver never cleaned up after itself. Windows detects this inconsistency and triggers a stop error rather than let the memory leak continue. Updating or removing the offending driver is the fix.

Affected Models

Windows 10
Windows 11
Windows 7
Windows 8.1
Windows Server

Common Causes

A buggy or outdated driver for a storage controller, USB device, or network adapter has a memory management flaw
Third-party disk encryption or backup software using a kernel driver with a memory leak bug
Antivirus or security software with a faulty real-time scanning driver
Recently installed hardware whose driver has not been properly tested on this version of Windows
Overclocked CPU or RAM causing instability in driver execution timing

How to Fix It

Download and run WhoCrashed (free from resplendence.com). It reads your minidump files and tells you which driver caused the BSOD in plain English. This is the fastest way to identify the offending driver.

Minidump files are small crash logs saved automatically every time Windows BSODs. WhoCrashed makes them readable without technical knowledge.
Once you know the driver name, update it. Search Device Manager (right-click Start > Device Manager) for the device associated with that driver, right-click it, and select Update Driver. Also check the manufacturer's website directly.

If WhoCrashed shows a driver name like 'XYZdrv.sys', search that filename online to find which product it belongs to.
If a third-party security program (antivirus, VPN, firewall) is suspected, temporarily disable its real-time protection and see if the crashes stop. If they do, update or uninstall that software.

Security software operates in the Windows kernel with the highest privileges. Bugs in these drivers can cause exactly this type of BSOD.
Check for Windows updates. Go to Settings > Windows Update and install all pending updates. Microsoft sometimes releases driver and kernel patches that fix known DRIVER_LEFT_LOCKED_PAGES crashes.

Some of these crashes are caused by bugs in Windows components themselves, not third-party drivers. Keeping Windows updated closes those gaps.
If you have overclocked your CPU or RAM, reset all settings to stock defaults in your BIOS. Memory running at above-rated speeds can cause subtle timing errors that manifest as driver failures.

Even XMP/EXPO memory profiles (which run RAM above its base spec) can occasionally cause instability. Try running at the default JEDEC speed to rule this out.

When to Call a Professional

This BSOD almost always points to a specific driver rather than failing hardware. If you cannot identify which driver is causing it, a technician can analyze the crash dump file to find the exact responsible driver. Crash dumps are saved in C:\Windows\Minidump and can be read with WinDbg or WhoCrashed tools.

Frequently Asked Questions

What does 'locked pages' mean in this context?

When a driver performs a disk read or write operation, it locks a portion of RAM so Windows cannot move that memory to the page file during the operation. This ensures the data stays in a fixed location while the hardware reads or writes it. After the operation finishes, the driver is supposed to unlock those pages. If the driver crashes or exits without unlocking, those pages stay permanently locked. Windows detects this and triggers the BSOD to prevent memory from being slowly consumed.

Can I find the crash dump myself without WhoCrashed?

Yes. Go to C:\Windows\Minidump and you will find .dmp files — one per crash. You can also use the free tool WinDbg from Microsoft Store to open them. In WinDbg, run the command: !analyze -v — and it will show you the driver that caused the crash. WhoCrashed is easier for non-technical users since it shows the same information in a simple report.

Is this a sign my PC has a virus?

Unlikely, but possible. Most occurrences are caused by legitimate but buggy drivers. However, some malware installs kernel drivers that are poorly written and cause exactly this type of crash. If the BSOD started right after visiting a suspicious website or installing software from an untrusted source, run a full scan with Windows Defender or Malwarebytes before updating drivers.