Old Microsoft-signed Linux boot files let attackers bypass Secure Boot on most PCs

Researchers at ESET found 11 old Microsoft-signed Linux boot components, called shims, that can be used to bypass UEFI Secure Boot on almost any PC, regardless of its operating system. The trick needs no new vulnerability: because these shims were signed years ago with a trusted Microsoft certificate and never revoked, an attacker with admin or boot-level access can copy an old vulnerable shim onto a machine and run untrusted code before the operating system loads. That enables stealthy bootkits that survive reinstalls and start before security tools. Microsoft revoked all 11 in June by blocklisting their hashes, which Windows applies automatically and Linux systems can pull through firmware updates.

Check

Confirm the June UEFI revocation update reached your systems: Windows applies it automatically, while Linux hosts should pull it through the firmware update service, and use ESET's check for the revoked hashes.

Affected

Almost any UEFI-based computer trusting Microsoft's third-party 2011 certificate (CVE-2026-8863, CVE-2026-10797), regardless of operating system; an attacker with boot-level access can load an old signed shim to defeat Secure Boot.

Fix

Apply the UEFI revocation update on Windows and Linux, disable third-party UEFI signing where it is not needed, consider Secured-core hardware, and protect against the admin access these attacks require.