win32k.sys MEMORY_MANAGEMENT (0x1a) affecting multiple computers in the last 2 months with no clear cause

Question

win32k.sys MEMORY_MANAGEMENT (0x1a) affecting multiple computers in the last 2 months with no clear cause

Filip Podraza | Acantha 20

Hello.

Multiple Windows 11 systems entering unrecoverable BSOD loop with MEMORY_MANAGEMENT (0x1A), subtype 0x1015, MiUnloadSystemImage

I am an MSP admin with multiple customer environments and have experienced a growing number of Windows 11 systems entering an unrecoverable BSOD loop over the last few weeks.

The issue has occurred across multiple hardware platforms including:

Dell Vostro 3525

Dell Vostro 3425

Dell Inspiron 15 3525

Dell Precision 3490

HP EliteBook 840 G7

Affected devices are running Windows 11 25H2.

Symptoms:

Users typically report returning to their computer in the morning and finding:

MEMORY_MANAGEMENT (0x1A)

What failed: win32k.sys

In a constant loop, Windows tries to boot and then goes to the above error message, and then shuts down, and so on, and the loop cannot be stopped.

Recovery attempts fail, including:

Startup Repair

Safe Mode

SFC

DISM

Uninstall Updates

All Windows Recovery options

We have also tried reseating all components, battery, RAM, disk.

The only reliable recovery method found so far has been a full Windows reinstall.

Memory Dump Analysis

We collected crash dump files from two affected systems, and event viewer logs from one affected system:

Example 1:

BUGCHECK_CODE: 1a 2 BUGCHECK_P1: 1015 3 PROCESS_NAME: smss.exe 4 Failure.Bucket: 0x1a_1015_nt!MiUnloadSystemImage

Example 2:

BUGCHECK_CODE: 1a 2 BUGCHECK_P1: 1015 3 PROCESS_NAME: smss.exe 4 Failure.Bucket: 0x1a_1015_nt!MiUnloadSystemImage

One dump's Arg2 address resolves to:

win32k.sys

Version: 10.0.26100.8655

Stack trace includes:

NtSetSystemInformation 2 MmUnloadSystemImage 3 MiUnloadSystemImage 4 KeBugCheckEx

Multiple unrelated hardware platforms affected.

Issue began within a similar time period. Appears to occur overnight in several cases. Not believed to be hardware-related due to the number and variety of affected devices. Some affected devices use third party anti-virus and security software, however checking the logs of this security software it does not seem to be blocking or quarantining any files or software prior or during the issue. Some affected devices had DisplayLink software installed, but other affected devices did not, so DisplayLink is not the common denominator. Review of CBS logs does not reveal obvious component store corruption or repair failures.

Could anyone review dump and log files if I could attach them and advise whether:

There are any known issues relating to:

Windows 11 25H2 win32k.sys MEMORY_MANAGEMENT (0x1A) subtype 0x1015 MiUnloadSystemImage failures

Whether the recurring failure bucket:

0x1a_1015_nt!MiUnloadSystemImage

is associated with any known Windows defect, servicing issue, or driver compatibility issue.

Any further diagnostic data could be collected from future affected devices prior to rebuild. Log collection has been scarce due to the urgency of this issue, as there is no fix for us but to re-install a device, however due to this being a recurring pattern we have started collecting logs.

Any further information required please let me know

cwood 5 Reputation points

2026-08-19T15:03:26.92+00:00

We have run into this situation recently as well, machines going down like flies. It seems to be spreading. Seems hardware agnostic, we are seeing it with the Lenovo laptops we provide. All of the mentioned steps are not helping, something seems seriously borked. Cannot even find the supposed .dmp or minidump files.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

7 answers

Your answer

cwood 5 Reputation points

2026-08-19T15:03:26.92+00:00

We have run into this situation recently as well, machines going down like flies. It seems to be spreading. Seems hardware agnostic, we are seeing it with the Lenovo laptops we provide. All of the mentioned steps are not helping, something seems seriously borked. Cannot even find the supposed .dmp or minidump files.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

I've managed to recover a device without rebuilding it. Download the Latest LCU from https://www.catalog.update.microsoft.com/Search.aspx?q=KB5121003 and put it on a USB drive it's about 5gb

Boot into WinRE cmd prompt.
Load the Registry offline
reg load HKLM\OFFSOFT C:\Windows\System32\Config\SOFTWARE
Backup key reg Key
"HKLM\OFFSOFT\Microsoft\Windows\CurrentVersion\Component Based Servicing" C:\CBS-backup.reg
Remove Exclusive Flag (causing cbs errors)
reg delete "HKLM\OFFSOFT\Microsoft\Windows\CurrentVersion\Component Based Servicing\SessionsPending" /v Exclusive /f
Unload Registry
reg unload HKLM\OFFSOFT
Make a scratch location
mkdir C:\Scratch
Apply the update from your usb drive
DISM /Image:C:\ /Add-Package /PackagePath:"E:\windows11.0-kb5121003-x64_dc58f03fef04b4c611e0db0ab3fadfb301194113.msu" /ScratchDir:C:\DISMScratch /LogPath:C:\LCU-DISM.log

I found that the hotpatch fails to apply properly with Threatlocker if you didn't add the Hotpatch policies they have recently updated. What happens is windows reports the update as successfull even if some of the dlls were blocked by Threatlocker then when the machine next reboots it runs into this error. We tried everything and were rebuilding devices as the only alternative but the above worked for me after days and days of troubleshooting and managing to get a device that was no longer needed by a client.

One thing we have not tried yet is removing the exclusive flag then uninstalling the hotpatch from DISM - will be doing that on the next affected device and report back here however applying the MSU definitely gets the machine back up and running without rebuilding

Kamil Łuczak 0 Reputation points

2026-09-06T18:28:13.07+00:00

This worked for me, thanks! Dead desktop after the July update (26200.8875) - 0xc0000001, then MEMORY_MANAGEMENT / win32k.sys. Uninstalling updates, System Restore and Safe Mode all failed. No BitLocker, no ThreatLocker, just a home PC, so this isn't limited to managed environments.

A few things to fix in the steps:

Step 3 needs the export keyword: reg export "HKLM\OFFSOFT...\Component Based Servicing" C:\CBS-backup.reg

Step 6 creates C:\Scratch but the DISM command uses C:\DISMScratch - make them match.

Rename the .msu files to something short first (I used 1.msu and 2.msu). Typing those full hashes in a recovery console is painful and easy to get wrong.

Always reg unload before running DISM, otherwise it fails with 0x80070020.

The SSU wouldn't apply offline (error 552 / 0x80070228), so I skipped it and applied the LCU on its own - that was enough. DISM reported success and the machine booted fine after a restart.

All data and programs intact, no rebuild needed.
Filip Podraza | Acantha 20 Reputation points

2026-09-07T09:05:52.9433333+00:00

Thanks, I'll try this the next time it happens.

Answer 2

map 0

We had the same issue that started to occur for past 3 weeks on one of our customers roughly 25 devices affected and still counting, these are different hardware vendors and then just this week started to occur with other customers.

We even raised a ticket with MS and no repair commands are working.... still working with MS :( for root cause..
The only addition for us is we have Bitlocker enabled for our customers and that is the initial prompt and then goes to the same error message / behavior.

Note: We found a work around on some devices but its NOT ALWAYS going to work, i would say only 30 to 40% chance of working.

On the affected device, try to disable Secure Boot entirely or if Dell (Put in in Audit Mode),
Then boot up normally, it will go to the same error message and once in Advance mode, try to select Start up settings > Then choose F7 - Disable driver signature enforcement.
There is a chance that it will boot to OS, however once you reboot you are going to see the same error message / issue.

Elot 5 Reputation points

2026-08-19T08:58:55.0733333+00:00

Do you use threatlocker by any chance?
cwood 5 Reputation points

2026-08-19T15:03:58.82+00:00

We are running into this, and use threatlocker. Is there a correlation?
Elot 5 Reputation points

2026-08-19T19:40:49.0666667+00:00

Yes, ThreatLocker is the cause. Log this to your AM ASAP. I believe it's a fault with certain versions of TL and windows hotpatch + hypervisor based security. We have three separate MSPs now who have encountered this issue.

You can potentially recover machines by disabling hypervisor based security and code integrity in BCD then repair installing windows but it's a complex process.

My suggestions for now would be to update all your clients to 10.12.10 ASAP, touch wood we haven't had any more occurrences on this version.
map 0 Reputation points

2026-08-19T19:49:31.5533333+00:00

@Elot , yes we have Threat Locker, do you know how is it related to TL?
Elot 5 Reputation points

2026-08-19T19:52:19.4933333+00:00

I did a fairly extensive root cause analysis on it, and we now have 3 (possibly 4 with you) confirmed MSPs with the issue. Upgrade to 10.12.10 and log it to your account manager ASAP.
Elot 5 Reputation points

2026-08-19T19:54:00.96+00:00

Just from the above, I believe it's a fault with how certain versions of threatlocker handle windows hotpatch when virtualisation based security is enabled.

Essentially the machines BSOD during update and then can no longer validate any system drivers that were part of the update.
John Poole 0 Reputation points

2026-08-20T17:07:41.0666667+00:00

No Threatlocker here, as an added data point.
cwood 5 Reputation points

2026-08-20T17:11:19.66+00:00

We've also had a few machines with a newer TL version run into the issue (0X-1A). But unsure what the subtype is at the moment.
Elot 5 Reputation points

2026-08-20T21:48:37.87+00:00

John can I ask if there were any other EDR/App control software installed? Yours is the first case I've found so far without Threatlocker so it depends the mystery a bit!
John Poole 0 Reputation points

2026-08-21T14:34:29.15+00:00

We are running S1.

Answer 3

Thank you for the discussion. This helped guide us to the root cause and fix.
It happens across manufacturers.
The correlation is that it happens to computers having both Intune Windows Autopatch enabled (the new default since June), and ThreatLocker without a policy allowing it. Path is
c:\windows\winsxs\amd64_microsoft-windows-hotpatches_31bf3856ad364e35_10.0.26100.8390_none_e16f6fade1afaebf\
Or search your Unified Audit in ThreatLocker for full path containing "hotpatch.dll".
TL support can help you set up the policy.

autopatch

If you have any that are stuck these user instructions can help them bring back (you will need to make sure TL policy is updated and TL agent restarted, and hotpatch installed while it is still online).

Power on the computer.
As soon as Windows begins to load and you see the blue screen error, hold the power button until the computer turns off.
Repeat this process 3 times.
On the next startup, Windows should display Preparing Automatic Repair.
Select Advanced Options.
Choose Troubleshoot → Advanced Options → Startup Settings.
Click Restart.
When the Startup Settings menu appears, press 7 or F7 for:
- Disable driver signature enforcement
Allow Windows to start normally.

Filip Podraza | Acantha 20 Reputation points

2026-09-07T08:37:26.4866667+00:00

Thanks Plamen. I am going to try this out. We already have the windows hotpatch built-in policy enabled, but maybe the built-in policy doesn't cover this?

Answer 4

John Poole 0

Ran across a computer with this same scenario yesterday.
Multiple efforts to repair were unsuccessful, including the majority of your list here. No hardware faults across a variety of diagnostic tests. My machine wasn't dumping any crash logs to the minidump folder.

Ended up doing a Windows Reset this PC / Keep my Files option to get it back operational. Of course, this isn't ideal.

I hope this isn't indicative of some larger problem with a faulty Microsoft update or something.

0 comments

Answer 5

Hello @Filip Podraza | Acantha

The consistency across unrelated hardware is significant here. Both dumps show BugCheck 0x1A with parameter 1 = 0x1015, the same nt!MiUnloadSystemImage failure bucket, and smss.exe as the active process. One dump also resolves the affected image to win32k.sys version 10.0.26100.8655.

Microsoft defines 0x1A MEMORY_MANAGEMENT as a severe memory-management error, but the module displayed on the BSOD isn't necessarily the component that originally corrupted memory. win32k.sys may therefore be where the corruption is detected during image unloading rather than the actual cause.

Since you've reproduced the same signature on Dell and HP systems and the machines fail at about the same point, I wouldn't treat RAM as the primary suspect yet. I would focus on finding a common software/servicing or kernel-driver component.

For the next affected machine, before rebuilding it, preserve at least:

C:\Windows\MEMORY.DMP

*C:\Windows\Minidump*

*C:\Windows\Logs\CBS*

*C:\Windows\Logs\DISM*

*C:\Windows\System32\winevt\Logs*

Then open the dump in WinDbg and start with:

!analyze -v

lmvm win32k

lm t n

!blackboxbsd

!blackboxntfs

!blackboxpnp

Microsoft specifically recommends !analyze for determining the exact 0x1A condition, and WinDbg can analyze both kernel and minidump files.

I would also compare the affected systems for common filter/kernel drivers, especially endpoint security/EDR, DLP, graphics/display components, remote-control agents, backup software, and other software that installs filesystem or kernel filters. The fact that some systems have DisplayLink and others don't already makes DisplayLink alone a less convincing common cause.

Driver Verifier can help identify a driver corrupting kernel memory, but I'd use it only on a test/reproducible machine, not broadly across customer production endpoints. Microsoft specifically documents Driver Verifier as a debugging mechanism for catching faulty drivers and memory corruption.

One additional point: I couldn't find Microsoft documentation currently identifying 0x1A_1015_nt!MiUnloadSystemImage with win32k.sys on Windows 11 25H2 as a confirmed known issue, nor a documented KB specifically fixing this signature. So I wouldn't state yet that this is a Windows defect.

However, with multiple unrelated machines producing essentially the same failure bucket and OS build, this is strong enough to justify opening a Microsoft support case and submitting the complete dumps. Two or more full dumps showing the same 0x1a_1015_nt!MiUnloadSystemImage signature will be considerably more useful than the BSOD screen itself.

Sharing these references with you:

Microsoft – Bug Check 0x1A: MEMORY_MANAGEMENT

Microsoft – Open a crash dump with WinDbg

Microsoft – Read small memory dump files

Please "Accept the Answer" if this information helped you. This will help us and others in the community.

Allan Solomon Mejia 7,915 Reputation points

2026-08-18T15:48:22.8766667+00:00

Hello @Filip Podraza | Acantha

Please let me know if you need any further assistance. Otherwise, if the information provided resolved your issue, please click “Accept Answer” to help others who may encounter the same problem.

Thank you!
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.