Environment
- Windows Server 2019, OS Build 17763.9020 (after KB5099538, July 14 2026 CU; KB5101008 in same wave)
- Ceph for Windows, both
ceph_reef_beta and ceph_squid latest MSIs
- wnbd.sys FileVersion 0.7.0.0, 86872 bytes
Symptom
After installing the July 2026 cumulative update, the WNBD driver no longer loads at boot.
Repair-install of the current MSI and reboots do not resolve it.
libwnbd.dll!WnbdOpenAdapterEx ERROR No WNBD adapter found.
rbd-wnbd: Could not fetch all mappings. Error: -2
Diagnosis
The WNBD SCSI Virtual Adapter device (ROOT\SCSIADAPTER\0000) reports:
CM_PROB_UNSIGNED_DRIVER (problem code 52)- System Event 219: driver
\Driver\wnbd failed to load for device ROOT\SCSIADAPTER\0000
- System Event 7026: boot-start driver
wnbd did not load
No CodeIntegrity/Operational 3076/3077 events are logged, so this is the legacy kernel-mode code-signing (KMCS) path rejecting the driver, not a WDAC policy.
Signature on the shipped wnbd.sys (identical in both reef and squid MSIs):
- Subject: CN=Cloudbase Solutions Srl
- Issuer: CN=SSL.com Code Signing Intermediate CA RSA R1
- NotBefore: 2021-08-13 / NotAfter: 2024-08-12 (expired)
- Thumbprint: E530EE278DEBA026C554FFF95790C66E4997061A
- Serial: 162D26CE77F9F91EC004497F996508CA
Get-AuthenticodeSignature returns Valid (file blob intact + timestamped), but the signing certificate is an ordinary commercial code-signing cert — not a WHQL/WHCP Microsoft signature and not on the cross-signed path. On a fully-patched Server 2019 the driver is no longer accepted by kernel-mode signing for a BOOT_START SCSI miniport.
Impact
Current public reef and squid MSIs cannot produce a kernel-loadable wnbd.sys on a fully-patched Server 2019 (and this will extend to any Windows build enforcing the newer kernel trust policy). Rolling back the CU is the only workaround, which is not viable long-term on patched hosts.
Request
Please re-release wnbd.sys with a valid signature via the Windows Hardware Compatibility Program (attestation/WHQL) signing so the driver is Microsoft-signed and loadable under current KMCS enforcement. A commercial-cert re-sign alone will not resolve this.
Environment
ceph_reef_betaandceph_squidlatest MSIsSymptom
After installing the July 2026 cumulative update, the WNBD driver no longer loads at boot.
Repair-install of the current MSI and reboots do not resolve it.
Diagnosis
The
WNBD SCSI Virtual Adapterdevice (ROOT\SCSIADAPTER\0000) reports:CM_PROB_UNSIGNED_DRIVER(problem code 52)\Driver\wnbdfailed to load for device ROOT\SCSIADAPTER\0000wnbddid not loadNo CodeIntegrity/Operational 3076/3077 events are logged, so this is the legacy kernel-mode code-signing (KMCS) path rejecting the driver, not a WDAC policy.
Signature on the shipped wnbd.sys (identical in both reef and squid MSIs):
Get-AuthenticodeSignaturereturns Valid (file blob intact + timestamped), but the signing certificate is an ordinary commercial code-signing cert — not a WHQL/WHCP Microsoft signature and not on the cross-signed path. On a fully-patched Server 2019 the driver is no longer accepted by kernel-mode signing for a BOOT_START SCSI miniport.Impact
Current public reef and squid MSIs cannot produce a kernel-loadable wnbd.sys on a fully-patched Server 2019 (and this will extend to any Windows build enforcing the newer kernel trust policy). Rolling back the CU is the only workaround, which is not viable long-term on patched hosts.
Request
Please re-release wnbd.sys with a valid signature via the Windows Hardware Compatibility Program (attestation/WHQL) signing so the driver is Microsoft-signed and loadable under current KMCS enforcement. A commercial-cert re-sign alone will not resolve this.