Microsoft Revokes 11-Year-Old UEFI Shim Bootloaders

In its latest security update, Microsoft has officially revoked a series of UEFI shim bootloaders that have been in active use across the Linux and Windows ecosystems for eleven years. The shims, originally signed by Microsoft to allow Linux distributions to boot on secure hardware, contained vulnerabilities that could be exploited to bypass Secure Boot.

By exploiting these vulnerabilities, local attackers or malware could execute unsigned, malicious code before the operating system loaded. This allowed for the installation of bootkits—highly persistent malware that resides in the motherboard firmware and remains invisible to standard security scanners operating within the OS.

Eliminating a Decades-Old Secure Boot Bypass Vector

While the revocation database is updated automatically on Windows machines, the change has caused boot failures on some Linux systems. Administrators must manually update their GRUB bootloaders and apply signed kernel updates before the firmware database is updated, or their systems will fail to recognize the boot files.

Operational Impact on Enterprise Linux Deployments

Security agencies, including CISA, have urged administrators to audit their systems and apply the updates immediately. Although manual firmware management introduces operational overhead, security professionals agree that closing the eleven-year-old Secure Boot loophole is critical for defending enterprise infrastructure.