Windows 11 KB5094126 HP EliteBook 840 G10 Boot Failure June 2026

What is the KB5094126 HP EliteBook 840 G10 Boot Failure?

The June 10, 2026 Patch Tuesday cumulative KB5094126 (Build 26100.4995 for 24H2, 26200.2410 for 25H2) installs cleanly on most hardware, but on the HP EliteBook 840 G10 — and its sibling 845 G10 / 860 G10 — it triggers a model-specific boot failure: after the post-install reboot, the HP splash logo appears, then the screen goes black and the keyboard backlight pulses three times before the machine resets in a loop. Some users see the HP Sure Start integrity-violation banner ("Sure Start has detected an issue with the BIOS") before the lock; others get the BitLocker recovery prompt and never reach the desktop again. This is not the generic [BitLocker recovery loop](/en/errors/windows-11-kb5089549-bitlocker-recovery-loop-hp) or the [EFI partition 0x800f0922 issue](/en/errors/windows-11-kb5094126-efi-partition-0x800f0922-june-2026); it is a conflict between HP Sure Start Gen 6, HP Tamper-Resistant Boot, and the new measured-boot manifest KB5094126 writes to the TPM PCR[7] slot.

HP and Microsoft confirmed the conflict on June 16, 2026 in HP advisory HPSBHF03978 and the KB5094126 advisory's updated "Known issues" section. HP shipped BIOS F.32 Rev. A on June 17 to resolve the underlying TPM PCR mismatch, but until you can install it, the fastest recovery is the Tamper-Resistant Boot toggle (step 2) followed by the KB5089573 downgrade path (step 6). This guide is scoped to the EliteBook 840/845/860 G10 with Intel Core Ultra 7 155U / 165U chips; older 13th Gen G10 variants are not affected.

When does it occur?

• HP EliteBook 840 G10, 845 G10 or 860 G10 with Intel Core Ultra (vPro included)
• Immediately after the KB5094126 post-install reboot
• HP splash → black screen → keyboard backlight pulses three times → soft reset (looping)
• HP Sure Start banner: "Sure Start has detected an issue with the BIOS — recovering"
• BitLocker recovery key prompt that accepts the key but reboots to the same loop
• Devices managed by Intune / SCCM that pushed KB5094126 outside business hours
• BIOS F.31 or earlier installed; F.32 and later are immune

Common causes

• KB5094126 writes a new measured-boot manifest that mismatches HP Sure Start Gen 6's expected PCR[7] hash on BIOS F.31 and earlier
• HP Tamper-Resistant Boot rejects the new manifest and triggers self-healing recovery, which writes a fallback boot entry above Windows
• The TPM 2.0 anti-hammering counter increments on each loop and locks the platform after the 3rd attempt
• Intel Core Ultra IPU (Image Processing Unit) firmware is downrev — IPU 1.7.1024.2870 or earlier interacts badly with the new WDDM 3.2 scheduler in KB5094126
• HP DriverPack 26.05 left an outdated HpSurePnp.sys filter driver that intercepts the boot manifest read
• BitLocker is suspended-but-active and the new manifest fails attestation on resume
• Intune devices pushed KB5094126 before HP's June 16 advisory landed, so the HP BIOS update was not staged first

Step-by-step fixes

1. Stop the boot loop and reach WinRE. Power off (hold power 10 s). Power on, and at the HP splash press F11 repeatedly until WinRE loads ("Choose an option" screen). If F11 fails, force three failed boots (power on → at HP logo, hold power 10 s) — Windows enters automatic repair on the fourth.

1. Disable HP Tamper-Resistant Boot temporarily. From WinRE → Troubleshoot → Advanced options → UEFI Firmware Settings → Restart. In BIOS Setup (Esc at power-on if F11 fails): Security → BIOS Sure Start → Tamper-Resistant Boot: Disable. Also set Security → Secure Boot Configuration → Secure Boot Customization: Custom temporarily. F10 to save, exit. Boot resumes; if the desktop loads, proceed to step 3.

1. Update HP BIOS to F.32 Rev. A (June 17, 2026). Once at the desktop: open HP Support Assistant (preinstalled) → My devices → Updates → install BIOS F.32 Rev. A for the 840 G10. If HPSA is broken, download directly from support.hp.com/drivers → search "EliteBook 840 G10" → BIOS → sp159842.exe (F.32). Run as admin, plug in AC power, do not interrupt. The BIOS flash + reboot takes 6–8 minutes; the screen will go black twice — normal.

1. Re-enable HP Sure Start protections. Reboot into BIOS (Esc at HP logo) → Security → BIOS Sure Start → Tamper-Resistant Boot: Enable → Secure Boot Customization: Standard → F10 to save. F.32 includes the corrected PCR[7] manifest, so the protections no longer false-positive against KB5094126.

1. Reset the TPM anti-hammering lockout. Open elevated PowerShell:

   Get-Tpm
   if ((Get-Tpm).LockoutCount -gt 0) { Clear-Tpm -AllowClear -AllowPhysicalPresenceRequired }

If LockoutCount is non-zero, the platform will lock again after a few reboots. Clear-Tpm requires a confirm at next boot — accept it. Re-suspend BitLocker before this if encryption is enabled (see step 7).

1. If you cannot reach the desktop — downgrade to KB5089573. From WinRE → Troubleshoot → Advanced options → Uninstall Updates → Uninstall latest quality update. Reboot. You return to KB5089573 (Build 26100.4845). Then pause updates for 35 days (Settings → Windows Update → Pause for 5 weeks, repeat) until you can stage BIOS F.32 first. This downgrade is reversible and HP-supported per HPSBHF03978.

1. Suspend BitLocker before re-applying KB5094126. With F.32 installed, open elevated PowerShell:

   Suspend-BitLocker -MountPoint "C:" -RebootCount 3

This skips encryption attestation for the next 3 reboots, including KB5094126's two post-install reboots. BitLocker auto-resumes after.

1. Update Intel Core Ultra IPU firmware to 1.7.1099.x or later. Device Manager → System devices → Intel(R) IPU Driver → right-click → Update driver → automatic. If Windows Update returns "best driver already installed," fetch from intel.com/content/www/us/en/download/828687 → install Intel IPU Driver Pack 1.7.1099.5125 (June 2026 release). This closes the WDDM 3.2 scheduler interaction that compounded the loop on Core Ultra silicon.

If it still doesn't work

If BIOS F.32 is installed and KB5094126 still triggers the loop, the residual cause is almost always the HP DriverPack's **HpSurePnp.sys filter driver — version 26.05.4.10 intercepts the boot manifest read at a layer F.32 cannot work around. Pull it: from a working boot, open Device Manager → View → Show hidden devices → Software components → HP Sure PnP → right-click → Uninstall device → Delete the driver software for this device. Reboot, then re-install HP DriverPack 26.06.2.x** (released June 17 with the fixed filter) from support.hp.com/drivers. If you cannot boot at all, repeat steps 1–2 to enter WinRE → Command Prompt and run:

dism /image:C:\ /remove-driver /driver:oem*.inf

Listing then removing HpSurePnp.sys by its oemNN.inf slot (use dism /image:C:\ /get-drivers first).

For fleet-managed devices, the HP CMSL (Client Management Script Library) module ships a one-liner: Get-HPBIOSUpdates -Flash -BitLocker Suspend -Quiet — push this through Intune as a remediation script targeting Core Ultra 840 G10s before re-deploying KB5094126. File support tickets at support.hp.com referencing HPSBHF03978 for a guaranteed advanced-tier route, and cross-reference Microsoft's KB5094126 advisory (microsoft.com/help/5094126) if you need the rollback under enterprise SLA. Patch the BIOS first, the OS second — that one-line policy resolves nearly every reported case.