win32k.sys MEMORY_MANAGEMENT (0x1a) affecting multiple computers in the last 2 months with no clear cause

Filip Podraza | Acantha 20 Reputation points
2026-08-17T13:10:42.4033333+00:00

Hello.

Multiple Windows 11 systems entering unrecoverable BSOD loop with MEMORY_MANAGEMENT (0x1A), subtype 0x1015, MiUnloadSystemImage

I am an MSP admin with multiple customer environments and have experienced a growing number of Windows 11 systems entering an unrecoverable BSOD loop over the last few weeks.

The issue has occurred across multiple hardware platforms including:

Dell Vostro 3525

Dell Vostro 3425

Dell Inspiron 15 3525

Dell Precision 3490

HP EliteBook 840 G7

Affected devices are running Windows 11 25H2.

Symptoms:

Users typically report returning to their computer in the morning and finding:

MEMORY_MANAGEMENT (0x1A)

What failed: win32k.sys

In a constant loop, Windows tries to boot and then goes to the above error message, and then shuts down, and so on, and the loop cannot be stopped.

Recovery attempts fail, including:

Startup Repair

Safe Mode

SFC

DISM

Uninstall Updates

All Windows Recovery options

We have also tried reseating all components, battery, RAM, disk.

The only reliable recovery method found so far has been a full Windows reinstall.

Memory Dump Analysis

We collected crash dump files from two affected systems, and event viewer logs from one affected system:

Example 1:

BUGCHECK_CODE: 1a 2 BUGCHECK_P1: 1015 3 PROCESS_NAME: smss.exe 4 Failure.Bucket: 0x1a_1015_nt!MiUnloadSystemImage

Example 2:

BUGCHECK_CODE: 1a 2 BUGCHECK_P1: 1015 3 PROCESS_NAME: smss.exe 4 Failure.Bucket: 0x1a_1015_nt!MiUnloadSystemImage

One dump's Arg2 address resolves to:

win32k.sys

Version: 10.0.26100.8655

Stack trace includes:

NtSetSystemInformation 2 MmUnloadSystemImage 3 MiUnloadSystemImage 4 KeBugCheckEx

Multiple unrelated hardware platforms affected.

Issue began within a similar time period. Appears to occur overnight in several cases. Not believed to be hardware-related due to the number and variety of affected devices. Some affected devices use third party anti-virus and security software, however checking the logs of this security software it does not seem to be blocking or quarantining any files or software prior or during the issue. Some affected devices had DisplayLink software installed, but other affected devices did not, so DisplayLink is not the common denominator. Review of CBS logs does not reveal obvious component store corruption or repair failures.

Could anyone review dump and log files if I could attach them and advise whether:

There are any known issues relating to:

Windows 11 25H2 win32k.sys MEMORY_MANAGEMENT (0x1A) subtype 0x1015 MiUnloadSystemImage failures

Whether the recurring failure bucket:

0x1a_1015_nt!MiUnloadSystemImage

is associated with any known Windows defect, servicing issue, or driver compatibility issue.

Any further diagnostic data could be collected from future affected devices prior to rebuild. Log collection has been scarce due to the urgency of this issue, as there is no fix for us but to re-install a device, however due to this being a recurring pattern we have started collecting logs.

Any further information required please let me know

Windows for business | Windows Client for IT Pros | Devices and deployment | Install Windows updates, features, or roles

7 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. David Dodson 0 Reputation points
    2026-08-26T17:56:54.55+00:00

    Short version: We have the exact same issue on multipel Dell Latitude 7440, 3420, 7450

    • 0x1A Memory_Management issue with what failed : win32k.sys

    Tried all the possible fixes here and ones found elsewhere
    Only known Solution: RESET PC (keep files) is the ONLY fix we have at the moment.

    • Devices had Threatlocker, but after removing it, we had more fail even with TL removed.
      No fix found that is quicker than a RESET for now.
      So far, none have re-occurred after the reset.
      :(

    Was this answer helpful?

    0 comments
  2. Zubair Khan 5 Reputation points
    2026-08-31T04:29:29.65+00:00

    I've managed to recover a device without rebuilding it. Download the Latest LCU from https://www.catalog.update.microsoft.com/Search.aspx?q=KB5121003 and put it on a USB drive it's about 5gb

    1. Boot into WinRE cmd prompt.
    2. Load the Registry offline
      reg load HKLM\OFFSOFT C:\Windows\System32\Config\SOFTWARE
    3. Backup key reg Key
      "HKLM\OFFSOFT\Microsoft\Windows\CurrentVersion\Component Based Servicing" C:\CBS-backup.reg
    4. Remove Exclusive Flag (causing cbs errors)
      reg delete "HKLM\OFFSOFT\Microsoft\Windows\CurrentVersion\Component Based Servicing\SessionsPending" /v Exclusive /f
    5. Unload Registry
      reg unload HKLM\OFFSOFT
    6. Make a scratch location
      mkdir C:\Scratch
    7. Apply the update from your usb drive
      DISM /Image:C:\ /Add-Package /PackagePath:"E:\windows11.0-kb5121003-x64_dc58f03fef04b4c611e0db0ab3fadfb301194113.msu" /ScratchDir:C:\DISMScratch /LogPath:C:\LCU-DISM.log

    I found that the hotpatch fails to apply properly with Threatlocker if you didn't add the Hotpatch policies they have recently updated. What happens is windows reports the update as successfull even if some of the dlls were blocked by Threatlocker then when the machine next reboots it runs into this error. We tried everything and were rebuilding devices as the only alternative but the above worked for me after days and days of troubleshooting and managing to get a device that was no longer needed by a client.

    One thing we have not tried yet is removing the exclusive flag then uninstalling the hotpatch from DISM - will be doing that on the next affected device and report back here however applying the MSU definitely gets the machine back up and running without rebuilding

    Was this answer helpful?

    3 people found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.