win32k.sys MEMORY_MANAGEMENT (0x1a) affecting multiple computers in the last 2 months with no clear cause

Question

win32k.sys MEMORY_MANAGEMENT (0x1a) affecting multiple computers in the last 2 months with no clear cause

Filip Podraza | Acantha 10

Hello.

Multiple Windows 11 systems entering unrecoverable BSOD loop with MEMORY_MANAGEMENT (0x1A), subtype 0x1015, MiUnloadSystemImage

I am an MSP admin with multiple customer environments and have experienced a growing number of Windows 11 systems entering an unrecoverable BSOD loop over the last few weeks.

The issue has occurred across multiple hardware platforms including:

Dell Vostro 3525

Dell Vostro 3425

Dell Inspiron 15 3525

Dell Precision 3490

HP EliteBook 840 G7

Affected devices are running Windows 11 25H2.

Symptoms:

Users typically report returning to their computer in the morning and finding:

MEMORY_MANAGEMENT (0x1A)

What failed: win32k.sys

In a constant loop, Windows tries to boot and then goes to the above error message, and then shuts down, and so on, and the loop cannot be stopped.

Recovery attempts fail, including:

Startup Repair

Safe Mode

SFC

DISM

Uninstall Updates

All Windows Recovery options

We have also tried reseating all components, battery, RAM, disk.

The only reliable recovery method found so far has been a full Windows reinstall.

Memory Dump Analysis

We collected crash dump files from two affected systems, and event viewer logs from one affected system:

Example 1:

BUGCHECK_CODE: 1a 2 BUGCHECK_P1: 1015 3 PROCESS_NAME: smss.exe 4 Failure.Bucket: 0x1a_1015_nt!MiUnloadSystemImage

Example 2:

BUGCHECK_CODE: 1a 2 BUGCHECK_P1: 1015 3 PROCESS_NAME: smss.exe 4 Failure.Bucket: 0x1a_1015_nt!MiUnloadSystemImage

One dump's Arg2 address resolves to:

win32k.sys

Version: 10.0.26100.8655

Stack trace includes:

NtSetSystemInformation 2 MmUnloadSystemImage 3 MiUnloadSystemImage 4 KeBugCheckEx

Multiple unrelated hardware platforms affected.

Issue began within a similar time period. Appears to occur overnight in several cases. Not believed to be hardware-related due to the number and variety of affected devices. Some affected devices use third party anti-virus and security software, however checking the logs of this security software it does not seem to be blocking or quarantining any files or software prior or during the issue. Some affected devices had DisplayLink software installed, but other affected devices did not, so DisplayLink is not the common denominator. Review of CBS logs does not reveal obvious component store corruption or repair failures.

Could anyone review dump and log files if I could attach them and advise whether:

There are any known issues relating to:

Windows 11 25H2 win32k.sys MEMORY_MANAGEMENT (0x1A) subtype 0x1015 MiUnloadSystemImage failures

Whether the recurring failure bucket:

0x1a_1015_nt!MiUnloadSystemImage

is associated with any known Windows defect, servicing issue, or driver compatibility issue.

Any further diagnostic data could be collected from future affected devices prior to rebuild. Log collection has been scarce due to the urgency of this issue, as there is no fix for us but to re-install a device, however due to this being a recurring pattern we have started collecting logs.

Any further information required please let me know

cwood 0 Reputation points

2026-08-19T15:03:26.92+00:00

We have run into this situation recently as well, machines going down like flies. It seems to be spreading. Seems hardware agnostic, we are seeing it with the Lenovo laptops we provide. All of the mentioned steps are not helping, something seems seriously borked. Cannot even find the supposed .dmp or minidump files.
Allan Solomon Mejia 5,420 Reputation points

2026-08-19T15:32:50.0666667+00:00

@cwood @map @John Poole @Filip Podraza | Acantha

Please let me know if you need any further assistance. Otherwise, if the information provided resolved your issue, please click “Accept Answer” to help others who may encounter the same problem.

Thank you!

3 answers

Your answer

cwood 0 Reputation points

2026-08-19T15:03:26.92+00:00

We have run into this situation recently as well, machines going down like flies. It seems to be spreading. Seems hardware agnostic, we are seeing it with the Lenovo laptops we provide. All of the mentioned steps are not helping, something seems seriously borked. Cannot even find the supposed .dmp or minidump files.
Allan Solomon Mejia 5,420 Reputation points

2026-08-19T15:32:50.0666667+00:00

@cwood @map @John Poole @Filip Podraza | Acantha

Please let me know if you need any further assistance. Otherwise, if the information provided resolved your issue, please click “Accept Answer” to help others who may encounter the same problem.

Thank you!

Answer 1

map 0

We had the same issue that started to occur for past 3 weeks on one of our customers roughly 25 devices affected and still counting, these are different hardware vendors and then just this week started to occur with other customers.

We even raised a ticket with MS and no repair commands are working.... still working with MS :( for root cause..
The only addition for us is we have Bitlocker enabled for our customers and that is the initial prompt and then goes to the same error message / behavior.

Note: We found a work around on some devices but its NOT ALWAYS going to work, i would say only 30 to 40% chance of working.

On the affected device, try to disable Secure Boot entirely or if Dell (Put in in Audit Mode),
Then boot up normally, it will go to the same error message and once in Advance mode, try to select Start up settings > Then choose F7 - Disable driver signature enforcement.
There is a chance that it will boot to OS, however once you reboot you are going to see the same error message / issue.

Elot 0 Reputation points

2026-08-19T08:58:55.0733333+00:00

Do you use threatlocker by any chance?
cwood 0 Reputation points

2026-08-19T15:03:58.82+00:00

We are running into this, and use threatlocker. Is there a correlation?
Elot 0 Reputation points

2026-08-19T19:40:49.0666667+00:00

Yes, ThreatLocker is the cause. Log this to your AM ASAP. I believe it's a fault with certain versions of TL and windows hotpatch + hypervisor based security. We have three separate MSPs now who have encountered this issue.

You can potentially recover machines by disabling hypervisor based security and code integrity in BCD then repair installing windows but it's a complex process.

My suggestions for now would be to update all your clients to 10.12.10 ASAP, touch wood we haven't had any more occurrences on this version.
map 0 Reputation points

2026-08-19T19:49:31.5533333+00:00

@Elot , yes we have Threat Locker, do you know how is it related to TL?
Elot 0 Reputation points

2026-08-19T19:52:19.4933333+00:00

I did a fairly extensive root cause analysis on it, and we now have 3 (possibly 4 with you) confirmed MSPs with the issue. Upgrade to 10.12.10 and log it to your account manager ASAP.
Elot 0 Reputation points

2026-08-19T19:54:00.96+00:00

Just from the above, I believe it's a fault with how certain versions of threatlocker handle windows hotpatch when virtualisation based security is enabled.

Essentially the machines BSOD during update and then can no longer validate any system drivers that were part of the update.
John Poole 0 Reputation points

2026-08-20T17:07:41.0666667+00:00

No Threatlocker here, as an added data point.
cwood 0 Reputation points

2026-08-20T17:11:19.66+00:00

We've also had a few machines with a newer TL version run into the issue (0X-1A). But unsure what the subtype is at the moment.
Elot 0 Reputation points

2026-08-20T21:48:37.87+00:00

John can I ask if there were any other EDR/App control software installed? Yours is the first case I've found so far without Threatlocker so it depends the mystery a bit!
John Poole 0 Reputation points

2026-08-21T14:34:29.15+00:00

We are running S1.

Answer 2

John Poole 0

Ran across a computer with this same scenario yesterday.
Multiple efforts to repair were unsuccessful, including the majority of your list here. No hardware faults across a variety of diagnostic tests. My machine wasn't dumping any crash logs to the minidump folder.

Ended up doing a Windows Reset this PC / Keep my Files option to get it back operational. Of course, this isn't ideal.

I hope this isn't indicative of some larger problem with a faulty Microsoft update or something.

0 comments

Answer 3

Hello @Filip Podraza | Acantha

The consistency across unrelated hardware is significant here. Both dumps show BugCheck 0x1A with parameter 1 = 0x1015, the same nt!MiUnloadSystemImage failure bucket, and smss.exe as the active process. One dump also resolves the affected image to win32k.sys version 10.0.26100.8655.

Microsoft defines 0x1A MEMORY_MANAGEMENT as a severe memory-management error, but the module displayed on the BSOD isn't necessarily the component that originally corrupted memory. win32k.sys may therefore be where the corruption is detected during image unloading rather than the actual cause.

Since you've reproduced the same signature on Dell and HP systems and the machines fail at about the same point, I wouldn't treat RAM as the primary suspect yet. I would focus on finding a common software/servicing or kernel-driver component.

For the next affected machine, before rebuilding it, preserve at least:

C:\Windows\MEMORY.DMP

*C:\Windows\Minidump*

*C:\Windows\Logs\CBS*

*C:\Windows\Logs\DISM*

*C:\Windows\System32\winevt\Logs*

Then open the dump in WinDbg and start with:

!analyze -v

lmvm win32k

lm t n

!blackboxbsd

!blackboxntfs

!blackboxpnp

Microsoft specifically recommends !analyze for determining the exact 0x1A condition, and WinDbg can analyze both kernel and minidump files.

I would also compare the affected systems for common filter/kernel drivers, especially endpoint security/EDR, DLP, graphics/display components, remote-control agents, backup software, and other software that installs filesystem or kernel filters. The fact that some systems have DisplayLink and others don't already makes DisplayLink alone a less convincing common cause.

Driver Verifier can help identify a driver corrupting kernel memory, but I'd use it only on a test/reproducible machine, not broadly across customer production endpoints. Microsoft specifically documents Driver Verifier as a debugging mechanism for catching faulty drivers and memory corruption.

One additional point: I couldn't find Microsoft documentation currently identifying 0x1A_1015_nt!MiUnloadSystemImage with win32k.sys on Windows 11 25H2 as a confirmed known issue, nor a documented KB specifically fixing this signature. So I wouldn't state yet that this is a Windows defect.

However, with multiple unrelated machines producing essentially the same failure bucket and OS build, this is strong enough to justify opening a Microsoft support case and submitting the complete dumps. Two or more full dumps showing the same 0x1a_1015_nt!MiUnloadSystemImage signature will be considerably more useful than the BSOD screen itself.

Sharing these references with you:

Microsoft – Bug Check 0x1A: MEMORY_MANAGEMENT

Microsoft – Open a crash dump with WinDbg

Microsoft – Read small memory dump files

Please "Accept the Answer" if this information helped you. This will help us and others in the community.

Allan Solomon Mejia 5,420 Reputation points

2026-08-18T15:48:22.8766667+00:00

Hello @Filip Podraza | Acantha

Please let me know if you need any further assistance. Otherwise, if the information provided resolved your issue, please click “Accept Answer” to help others who may encounter the same problem.

Thank you!