Microsoft has released an update to fix a critical vulnerability in Secure Boot. However, the update prevents dual-boot systems running Linux from booting with that operating system.

Microsoft released an update last Tuesday to fix a bug in Secure Boot. However, this update has unpleasant side effects for users who run Windows and Linux on the same system. After installing the patch, you will no longer be able to boot Linux with Secure Boot enabled.

The update itself fixes a problem from 2022 that allowed attackers to bypass Secure Boot. This vulnerability is based on a problem in the GRUB bootloader. Hackers could load code via GRUB that is still malicious, while Secure Boot is designed to prevent such a thing.

Nevertheless installed

The patch seems to be a bit too thorough. Anyone who has installed the update will no longer be able to boot numerous Linux systems in a dual-boot configuration with Windows. Microsoft also does not seem to be inadvertently blocking fraudulent code during the boot process.

However, Microsoft was not unaware of the problem. Redmond promised not to simply roll out the patch to dual-boot systems that also run Linux. For some reason, that happened anyway. For now, Microsoft has made another comment.

Temporary solution

The simplest solution to the problem is to temporarily disable Secure Boot via the EFI settings until the problem is resolved. This brings security risks, but these are acceptable compared to the alternative of no longer using Linux.

There is also a workaround where you remove the SBAT policy that Microsoft added with the update. That is the cause of the problem after all. To do this, you still have to disable Secure Boot and then log into Linux. Remove the policy there sudo mokutil –set-sbat-policy delete. Reboot, log into Linux again and reboot to re-enable Secure Boot. The solution was suggested by a user on the Linux Mint forum.