> ## Content Index
> Fetch the complete content index at: https://itsfoss.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Oh, no! Windows Security Update Breaks Dual-Boot Linux Systems
- URL: https://itsfoss.com/news/windows-breaks-linux-dual-boot/
- Published: 2024-08-22T10:36:41.000Z
- Updated: 2025-05-16T06:48:44.000Z
- Description: As if Linux users weren't disappointed enough with Microsoft Windows...
- Author: Sourav Rudra
- Tags: Linux, News, #Import 2025-11-08 21:15

[Microsoft](https://www.microsoft.com/?ref=itsfoss.com) is known for their signature, “*my way or the highway*” approach when it comes to their offerings, with the Windows operating system being the most prominent one among those.

Many in the FOSS community disagree with that approach, with a [strong rejection](https://x.com/siptruk/status/1817411166139826540?ref=itsfoss.com) of such practices, suggesting people go for more open options for their operating systems and applications, and I agree with them.

Unfortunately, that same approach has now **affected many Linux distribution users**, who were sent scampering searching for a fix to a problem caused by a Windows update (*who would've expected that?)*.

## Microsoft Slips Up: Linux Users Beware!

![a screenshot showing the verifying shim sbat data failed error on a dual boot system with windows and linux ](https://itsfoss.com/content/images/2024/08/Windows_Dual_Boot_Error.png)

Source: [paku1234](https://www.reddit.com/r/linux4noobs/comments/1euuiwv/please%5Fhelp%5Ferror%5Fverifying%5Fshim%5Fsbat%5Fdata%5Ffailed/?ref=itsfoss.com)

First spotted by [Ars Technica](https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/?ref=itsfoss.com), a monthly Windows update pushed on August 13 that included a fix to a two-year-old vulnerability, [CVE-2022-2601](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-2601?ref=itsfoss.com), with an **8.6 CVSS severity rating**, caused dual-boot systems with Windows and Linux distros to **not boot**.

That **fix was meant to tackle an issue with the GRUB bootloader**, which allowed malicious actors from carrying out-of-bound writes, and possibly bypass secure boot.

But, it caused some collateral damage in the process. After updating, many users, including users of [Ventoy](https://github.com/ventoy/Ventoy/issues/2947?ref=itsfoss.com), and [Ubuntu 24.04](https://community.frame.work/t/sbat-verification-error-booting-linux-after-windows-update/56354?ref=itsfoss.com), reported that they were shown the following error:

> Verifying shim SBAT data failed: Security Policy Violation   
>  
> Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation

This update installed an [SBAT](https://www.gnu.org/software/grub/manual/grub/html%5Fnode/Secure-Boot-Advanced-Targeting.html?ref=itsfoss.com), which is an acronym for *Secure Boot Advanced Targeting*, a Linux-focused method for discarding various components in the boot path using generation numbers embedded into the EFI binaries. (*apologies for the jargon*)

However, **this mechanism was meant to run with devices only running Windows**, and, [according to Microsoft](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-2601?ref=itsfoss.com#:~:text=The%20SBAT%20value%20is%20not%20applied%20to%20dual%2Dboot%20systems%20that%20boot%20both%20Windows%20and%20Linux%20and%20should%20not%20affect%20these%20systems.), this should not have caused any issues on dual-boot systems, at least on newer Linux distributions.

But, as we know already, it did. 😑

Following these revelations, in [a statement](https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/?ref=itsfoss.com#:~:text=This%20update%20is%20not%20applied%20when%20a%20Linux%20boot%20option%20is%20detected.%20We%20are%20aware%20that%20some%20secondary%20boot%20scenarios%20are%20causing%20issues%20for%20some%20customers%2C%20including%20when%20using%20outdated%20Linux%20loaders%20with%20vulnerable%20code.%20We%20are%20working%20with%20our%20Linux%20partners%20to%20investigate%20and%20address.), Microsoft mentioned that they were aware of “*some secondary boot scenarios are causing issues for some customers*”, and that they were working with their Linux partners to investigate and address the issue.

Thankfully, **the community has come to the rescue**, with [manutheeng](https://forums.linuxmint.com/memberlist.php?mode=viewprofile&u=381346&ref=itsfoss.com), a member of the Linux Mint forums, finding [a solution](https://forums.linuxmint.com/viewtopic.php?t=427297&sid=dab5f35699069b1d030e710a1eb3c793&ref=itsfoss.com#:~:text=rev%20...%20cess/34996-,In%20case%20this%20can%20help%20anyone%2C%20here%20is%20what%20worked%20for%20me%3A,-1.%20Disable%20Secure) for Ubuntu in an old post on the [Ubuntu forums](https://discourse.ubuntu.com/t/sbat-revocations-boot-process/34996?ref=itsfoss.com). 

### The Solution

- First, disable Secure Boot from the UEFI menu.
- Then, log into Ubuntu with the user of your choice.
- Now, open a terminal and execute the following command:

```
 sudo mokutil --set-sbat-policy delete 

```

- After that, reboot your PC to see the changes.
- Now, if you'd like, you can re-enable Secure Boot from the UEFI menu.

The above steps should also work with any [Ubuntu-based](https://itsfoss.com/best-ubuntu-based-linux-distros/) Linux distribution. If that doesn't work, then you might be facing what a Framework laptop user [faced](https://community.frame.work/t/sbat-verification-error-booting-linux-after-windows-update/56354/2?ref=itsfoss.com).

### Closing Thoughts

If dual-boot systems were more common, then this issue would've been treated with more haste, like the [CrowdStrike incident](https://en.wikipedia.org/wiki/2024%5FCrowdStrike%5Fincident?ref=itsfoss.com) that took place last month, but that was not Microsoft's fault.

So, it's better than nothing. 🙂

Ultimately, there's still the matter of [Secure Boot](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot?ref=itsfoss.com) being an absolute mess, that has left many people questioning whether this could've been implemented in a better way. 

I think that it could've, the PC industry rushed its implementation before it was ready.

*💬 What about you? Were you impacted by these Windows update shenanigans? Let me know below!*