CrowdStrike outage explained: 21 fields, 20 slots, 8.5M blue screens

The July 19, 2024 outage traced to an out-of-bounds read in CrowdStrike's Falcon kernel driver: a template declared 21 input fields while the code supplied 20. Channel File 291 spread in 78 minutes and blue-screened about 8.5 million Windows machines into boot loops.

• Bad Channel File 291 shipped at 04:09 UTC and was reverted at 05:27, a 78-minute window
• The field mismatch shipped in February but stayed hidden behind a wildcard in field 21
• Recovery was manual: Safe Mode, delete one file, and BitLocker recovery keys first
• Delta cancelled about 7,000 flights and is claiming at least $500 million