Re:Linux and Secure Boot certificate expiration (2025)
by charcircuit on Monday June 22, 2026 @09:24PM
(#48638956)
How do desktop Linux distros avoid attackers from rolling back the operating system to a vulnerable, but signed version?
[ Parent
| on HN ]
Re:Linux and Secure Boot certificate expiration (2025)
by Sateallia on Tuesday June 23, 2026 @01:07AM
(#48640559)
This is not an issue specific to Linux, Windows installations can be downgraded as well. As for the mechanism, UEFI devices, alongside key updates, also get revocation list updates.
Re:Linux and Secure Boot certificate expiration (2025)
by charcircuit on Tuesday June 23, 2026 @02:43AM
(#48641220)
Strangely I feel like I've never seen one of these. It would be needed after every major kernel / user land exploit. It would also need rollback protection on the motherboard itself so you couldn't just remove the updated keys / revocations.