Microsoft has a great technical breakdown of the CrowdStrike incident. The root cause is an access violation in CrowdStrike’s kernel mode driver.

There are valid reasons for security software to run in the kernel but it causes such bugs to be fatal. Key takeaways

1. It’s unlikely Microsoft will make OS changes to prevent this from happening as it also restricts CrowdStrike’s security product.

2. There were inadequate testing and deployment practices at CrowdStrike.

https://www.microsoft.com/en-us/security/blog/2024/07/27/windows-security-best-practices-for-integrating-and-managing-security-tools/