The May Windows Patch Failed on a Full EFI Partition

Microsoft closed a May 12 Windows 11 security update failure that rolled back at 35 to 36 percent when the EFI System Partition had 10 MB or less free. The package was KB5089549, and the error code was 0x800f0922.

The patch was also moving 2023 Secure Boot certificates and fresh boot-manager files onto that same hidden FAT32 volume. On PCs that still carry a 100 MB OEM layout, there was nowhere left to write.

KB5089549 Rolled Back at 35 Percent

KB5089549, released May 12, 2026, took Windows 11 24H2 and 25H2 to OS builds 26100.8457 and 26200.8457. On machines with almost no room left on the EFI System Partition, setup ran through the early stages, then died during reboot and undid the change.

Affected PCs showed the familiar rollback line, “Something didn’t go as planned. Undoing changes.” Windows Update listed 0x800f0922. CBS logs at C:\Windows\Logs\CBS\CBS.log named the real constraint.

This issue affects devices with limited free space on the EFI System Partition (ESP), especially when the device has 10 MB or less space available.

Microsoft, Windows 11 version 24H2 release health

The same dashboard said the install could fail during reboot at about 35 to 36 percent complete. Log lines matched that story: “SpaceCheck: Insufficient free space,” “ServicingBootFiles failed. Error = 0x70,” and a SpaceCheck note that third-party or OEM files outside Microsoft boot directories were using the volume.

James Borders, posting on Microsoft Q&A about a Dell Alienware Aurora R16, measured the partition at 96.0 MB total with 1.3 MB free. That is the tripwire in hardware form. Microsoft opened the known issue on May 15, 2026 at 14:28 PT, three days after Patch Tuesday.

The 200 MB Floor Windows Already Published

The EFI System Partition is the FAT32 volume the firmware reads before Windows starts. It holds the boot manager, the Boot Configuration Data store, and OEM extras that never show up in File Explorer. Microsoft’s current hardware guide already treats 100 MB as too small.

That guide sets a 200 MB minimum on 512-byte drives and 300 MB on 4K native drives. It also says the ESP should not hold Windows Recovery tools or other stray files. A 16 MB Microsoft Reserved partition sits beside it and does not store user data.

EFI PARTITION SIZE FLOORS

Those four figures are not rivals for one measurement. 100 MB is the legacy total size. 200 MB and 300 MB are Microsoft’s current totals. 512 MB is HP’s imaging target. 10 MB is how much free space was left when May’s boot-file write failed.

Windows Setup on a clean disk can still stamp a 100 MB ESP, and in-place upgrades from Windows 10 keep whatever the OEM laid down years earlier. Microsoft Q&A threads on 25H2 feature upgrades describe the same 0x800f0922 stop on those 100 MB volumes, with no in-place resize tool in the cumulative pipeline.

Secure Boot Files Shared That Tiny Volume

KB5089549 was not a quiet quality rollup. Its own support note led with Windows Secure Boot certificate expiration and said the update added a new SecureBoot folder under C:\Windows on eligible devices, plus extra targeting data so more PCs could receive the 2023 certificates automatically.

The same package included a boot manager servicing update meant to keep devices from dropping into BitLocker recovery after boot-file writes, a hangover from the April 2026 security update. All of that work ends up on, or staged toward, firmware-adjacent storage. On a 100 MB ESP already packed with OEM BIOS images, the SpaceCheck had nothing left.

2011 SECURE BOOT CERTIFICATES

Microsoft’s certificate bulletin is blunt about the cost of missing that swap. PCs that never get the 2023 set still boot and still take ordinary Windows updates. They stop getting new protections for early boot components, including Boot Manager, Secure Boot databases, revocation lists, and fixes for new boot-level bugs.

The 2011 Secure Boot certificates began expiring in June 2026, in the same season KB5089549 tried to finish the rollout. A servicing update that cannot write boot files is a security update that never lands on the PCs that needed it most.

How Admins Bought Time Without Resizing Disks

Microsoft never published a one-click resize for the ESP. While the known issue was open, the supported paths all worked around the space check instead of growing the volume.

THREE WAYS PAST THE 0x800F0922 ROLLBACK

• Later cumulative: Install KB5089573 or any Windows 11 update dated May 26, 2026 or later, then skip the older workarounds.
• Known Issue Rollback: Consumers received KIR through Windows Update; managed fleets installed the KB5089549 260514_06221 Group Policy template and set the matching policy to Disabled.
• EspPaddingPercent: Microsoft Q&A guidance pointed at HKLM\SYSTEM\CurrentControlSet\Control\Bfsvc, a REG_DWORD named EspPaddingPercent set to 0, then a restart and a retry of KB5089549.

KIR is the enterprise-shaped version of the same idea. Microsoft ships an MSI policy definition, admins import it under Computer Configuration, Administrative Templates, and force a refresh with gpupdate. Default Group Policy can take 90 to 120 minutes to land. None of those steps add megabytes to the FAT32 volume. They only stop this month’s boot-file write from failing the check.

Deleting font files under EFI\Microsoft\Boot\Fonts, or OEM BIOS backup images, is the other folk fix. It can free enough space for one patch and it is also how people brick a vendor recovery tool. Microsoft’s own partition guide still says the ESP should not hold those extras in the first place.

The May 26 Preview Stopped the Rollback

Microsoft resolved the May 2026 install failure in the May 26 preview cumulative, KB5089573, at 14:00 PT. That is 14 days after KB5089549 shipped. The preview moved 24H2 and 25H2 to builds 26100.8524 and 26200.8524 and listed 30 changes, including the Low Latency Profile work and Shared Audio.

The company told anyone already on KB5089573 or later not to use a workaround. Anyone still sitting on a May 12-era build could keep KIR or the registry value until they moved forward. On May 29, the KB5089549 support page was edited to point the known issue at that preview instead of leaving it open.

THE MAY 2026 SERVICING TIMELINE

1. May 12, 2026: KB5089549 ships as the May security update for Windows 11 24H2 and 25H2.
2. May 15, 2026: Microsoft opens the 0x800f0922 ESP known issue at 14:28 PT.
3. May 26, 2026: KB5089573 preview marks the issue resolved at 14:00 PT.
4. June 9, 2026: June Patch Tuesday cumulative KB5094126, build 26100.8655, carries the later servicing to PCs that skipped the preview.
5. June 24, 2026: Microsoft Corporation KEK CA 2011 expires, the first of the 2011 Secure Boot certificates to fall off the calendar.

The June 9 package is the mandatory path the May 26 preview promised. It does not show up on the known-issue row as the resolver, because Microsoft had already closed that row on the preview. “KB5089573 and later” is the rule, and 26100.8655 is later than 26100.8524.

What the preview did not do is enlarge anyone’s EFI partition. Feature updates to 25H2 still fail with 0x800f0922 on a 100 MB ESP, the same code, because Microsoft has not shipped an auto-resize for that volume during an in-place upgrade. The May rollback is over. The layout that caused it is not.

HP Now Asks for 512 MB on New Images

HP’s business-PC note is the vendor document that matches the May failure. The company tells imaging teams to set a minimum of 512 MB for the ESP whenever they deploy, reimage, or restore an HP Windows PC, and to stop using 100 MB layouts.

HP lists the reason in one sentence: a smaller ESP, especially a legacy 100 MB ESP, may not leave enough space for Windows boot servicing, Secure Boot updates, HP BIOS recovery content, HP UEFI diagnostics, and firmware update files. That is the “third-party/OEM files outside of Microsoft boot directories” line from the CBS log, written as a deployment rule.

IT shops that clone older images, or that still run a DiskPart script with create partition efi size=100, will rebuild the same trap on new hardware. Home users who only click Check for updates never see the partition, cannot extend it in Disk Management when free space is not adjacent, and were never the audience for KIR Group Policy.

KB5089573 stopped May’s security update from rolling back. PCs that still boot from a 100 MB EFI volume will hit the next SpaceCheck the next time boot files grow, and the Windows Production PCA 2011 certificate still expires on October 19, 2026.

Frequently Asked Questions

What Does Error 0x800f0922 Mean on Windows 11?

0x800f0922 is a generic CBS installer failure, not a code that only means “EFI partition full.” The same value has shown up on Secure Boot DBX updates, WinRE servicing, and component-store problems, so the CBS.log SpaceCheck and ServicingBootFiles lines are the proof that May’s case was ESP space rather than a broken download.

How Do I Check Free Space on the EFI System Partition?

From an elevated Command Prompt, run mountvol Y: /s to mount the ESP, then fsutil volume diskfree Y: to print total and free bytes, then mountvol Y: /d to remove the letter. Disk Management often reports the volume as 100 percent free even when it is not, which is why the mount-and-measure steps matter before anyone resizes anything.

Do I Still Need the EspPaddingPercent Registry Change?

No, not if the PC has installed KB5089573 or any later cumulative, including the June 9, 2026 update KB5094126. Microsoft said workarounds are unnecessary after a May 26, 2026 or newer package; the registry value only relaxed the free-space check so the original May 12 build could finish.

Why Do OEM PCs Fill the EFI Partition Faster?

Factory images often store BIOS backup payloads, UEFI diagnostics, and firmware update files on the ESP beside Microsoft’s boot manager. Those extras are what the CBS SpaceCheck flagged as third-party or OEM files outside Microsoft boot directories, and they are why a 100 MB volume that looks fine on a clean retail install runs out on a branded laptop.

Will Windows Still Boot After the 2011 Certificates Expire?

Yes. Microsoft says devices that never receive the 2023 certificates continue to start and continue to install standard Windows updates. What they lose is the ability to take new Boot Manager updates, Secure Boot database and DBX revocations, and mitigations for boot-level bugs found after the 2011 set expires.

The servicing fix is in every current Windows 11 24H2 and 25H2 cumulative. The 100 MB volumes that tripped May’s SpaceCheck are still on disk, waiting for the next boot-file write that does not fit.