[Bug] Claude Desktop MSIX leaks kernel non-paged pool via NTFS CCB allocations (~2.2 GB/hour)

Status Closed — duplicate

Maintainer reply None cached

Activity 1 comment · opened Aug 10, 2026 · closed Aug 15, 2026

Bug Description

Claude Desktop (MSIX 1.25927.0.0) leaks kernel non-paged pool at ~2.2 GB/hour via NTFS CCB allocations

Summary

Claude Desktop installed from the Microsoft Store (MSIX package
Claude_1.25927.0.0_x64__pzs8sxrjxfjjc) causes a kernel-mode non-paged pool leak on
Windows 11. While the app is running, the NtFC pool tag (allocated by Ntfs.sys, one
Context Control Block per file open) grows continuously at roughly 2.2 GB/hour and is
never released. Over a 9-hour session it consumed 19.6 GB of non-paged pool.

The leaked memory is in kernel non-paged pool, so:

It is invisible in Task Manager — the Claude Desktop processes themselves look

entirely normal (18 processes, ~2.7 GB total commit, small working sets).

It cannot be paged out, trimmed, or reclaimed by any user-mode means.
It is only released by a reboot.

The leak starts within one minute of launching the app and stops instantly and completely
when the app is closed. This was verified with minute-resolution monitoring across a
two-day clean baseline.

Claude Code CLI (~/.local/bin/claude.exe) does not exhibit this behaviour — it ran
continuously throughout the entire baseline period and during all measurements with no
effect on the pool.

Environment

| | |
|---|---|
| OS | Windows 11 Pro, build 26100 |
| RAM | 63 GB |
| Claude Desktop | Claude_1.25927.0.0_x64__pzs8sxrjxfjjc, version 1.25927.0.0 (Microsoft Store / MSIX) |
| Filesystem | NTFS, 3 fixed volumes (C:, D:, E:) |
| FS filter drivers present | wcifs, bindflt (MSIX virtualisation), Symantec Endpoint Protection 14.3.11232, UnionFS, CBfs |

Impact

This is a hard denial-of-service on the machine given enough uptime.

An earlier occurrence (before monitoring was in place) exhausted the machine:
non-paged pool reached 44.7 GB of 63 GB, with NtFC alone at 41.2 GB and
450,320,007 outstanding allocations. Available physical memory fell to 142 MB, the
system thrashed continuously, and simple operations took minutes. Only a reboot recovered
it.

In the measured occurrence documented below, the leak was caught at 19.6 GB and stopped
by closing the app before the machine became unusable.

Evidence

1. Two-day clean baseline (Claude Desktop not running)

Minute-resolution sampling of the NtFC pool tag via
NtQuerySystemInformation(SystemPoolTagInformation). 3,040 consecutive samples from
2026-08-07 16:03 to 2026-08-09 20:01, zero gaps:

Timestamp            NonPagedMB  NtFC_MB  NtFC_Outstanding  AvailMB
2026-08-09 19:57:43  1156        0        9                 45414
2026-08-09 19:58:44  1155        0        9                 45471
2026-08-09 19:59:46  1155        0        9                 45420
2026-08-09 20:00:47  1156        0        9                 45407
2026-08-09 20:01:49  1155        0        9                 45411

NtFC held at 0 MB / 9 outstanding for the entire two days. Non-paged pool was flat
at ~1,155 MB. Chrome, VS Code, Claude Code CLI, Logitech Options+, Symantec Endpoint
Protection and a corporate asset-management agent were all running throughout.

2. Onset — exactly coincident with app launch

Claude Desktop processes were created at 08:20:32 – 08:20:40:

Timestamp            NonPagedMB  NtFC_MB  NtFC_Outstanding
2026-08-10 08:18:32  964         0        9
2026-08-10 08:19:33  962         0        9
2026-08-10 08:20:35  970         2        21,671        <-- app launched 08:20:32-40
2026-08-10 08:21:37  1232        37       403,921
2026-08-10 08:22:39  1298        72       790,376
2026-08-10 08:23:41  1333        108      1,177,146
2026-08-10 08:24:44  1368        144      1,576,133
2026-08-10 08:25:46  1405        180      1,968,793

A quantity that had not moved in two days went from 9 outstanding allocations to
1.97 million in five minutes.

3. Linear growth over 9 hours

Timestamp            NonPagedMB  NtFC_MB  NtFC_Outstanding  AvailMB
2026-08-10 08:20:35  970         2        21,671            40091
2026-08-10 10:00:35  4737        3545     38,723,030        31340
2026-08-10 12:00:11  9300        7867     85,928,890        27181
2026-08-10 14:00:46  14133       12417    135,629,792       20624
2026-08-10 16:00:23  18795       16880    184,371,695       17715
2026-08-10 17:10:25  21588       19559    213,641,424       14795

Measured rate, steady and li…
Note: Content was truncated.

View original on GitHub ↗

This issue has 1 comment on GitHub. Read the full discussion on GitHub ↗