Microsoft update breaks GRUB on dual-boot systems

Ah, secure boot, the bane of many running anything other than Windows. While it’s already been found to be utterly useless by now, it’s still a requirement for Windows 11, and ever since it became part of PCs about a decade or so ago, it’s been causing headaches for people who don’t use Windows. Yesterday, Microsoft released a patch for a two-year-old vulnerability in the GRUB bootloader, and while the company claimed it would only be installed on single-boot Windows machines, that clearly wasn’t the case as right after its release, people dual-booting Linux and Windows found their Linux installations unbootable.

Tuesday’s update left dual-boot devices—meaning those configured to run both Windows and Linux—no longer able to boot into the latter when Secure Boot was enforced. When users tried to load Linux, they received the message: “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.” Almost immediately support and discussion forums lit up with ​​reports of the failure.
↫ Dan Goodin at Ars Technica

The fix is both easy and hilarious: disable secure boot, and you’re good to go. You can also get a bit more technical and remove the SBAT installed by this update, but while that will allow you to keep booting with secure boot enabled, it will leave you vulnerable to the issue the SBAT was supposed to fix. The efficacy of secure boot in home environments is debatable, at best, and while I’m not going to advise anyone to just turn it off and forget about it, I think most OSNews readers can make an informed decision about secure boot by themselves. If you’re using corporate machines managed by your employer’s IT department, you obviously need to refer to them.

Microsoft itself has not yet commented on this issue, and is not responding to questions from press outlets, so we’re currently in the dark about how such a game-breaking update got out in the wild.

Regardless, this once again shows just how annoying secure boot is. In many cases, the boot problems people trying out Linux run into caused by secure boot, but of course, the blame is placed squarely on Linux, and not on secure boot itself being a hot mess.