Microsoft spent two years on a patch that locked Linux users out of their PCs
August 2024 Secure Boot SBAT update broke Linux dual-boot machines
The market's verdict: +3.6% on MSFT in the week after.
What actually happened
The August 13, 2024 updates shipped a Secure Boot SBAT policy, two years in preparation, that was supposed to harden against bootkits and skip dual boot systems, except the detection failed and Linux installations stopped booting entirely with a Security Policy Violation error. Ubuntu, Fedora and Rocky users found half of their computer had been bricked by the other half's vendor. Microsoft's fix arrived in September, and residual cases lingered until May 2025, nine months of "have you tried uninstalling Windows' opinion of your bootloader". A patch that protective had finally protected the PC from being used.
This one is well documented.
Were you affected? Unbreak it
Fixed in the September 2024 and later updates
Microsoft has acknowledged this issue; a fix ships in an out-of-band or next cumulative update. Check Windows Release Health before manual workarounds.
Linux side dead? Remove the SBAT policy from a live USB
Boot any Linux live USB and delete the SBATPolicy EFI variable from the firmware (or reinstall shim/grub from the live session), then boot normally. Windows-side, the September 2024 and later updates undo the policy without extra steps.
Links
-
Impact
- Ars Technica (publication)
↳ caused by KB5041585 (Secure Boot SBAT policy)
Timeline
- Aug 13, 2024 Confirmed First reports came in.
- May 13, 2025 Fixed Fully fixed nine months later, in the May 2025 updates.