Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 24. Updating the Secure Boot Revocation List

Update the UEFI Secure Boot Revocation List to identify software with known security issues and prevent it from compromising the boot process.

24.1. The Secure Boot Revocation List
Copy link

The UEFI Secure Boot Revocation List, or the Secure Boot Forbidden Signature Database (dbx), is a list that identifies software that Secure Boot no longer allows to run.

When a security issue or a stability problem is found in software that interfaces with Secure Boot, such as in the GRUB boot loader, the Revocation List stores its hash signature. Software with such a recognized signature cannot run during boot, and the system boot fails to prevent compromising the system.

For example, a certain version of GRUB might contain a security issue that allows an attacker to bypass the Secure Boot mechanism. When the issue is found, the Revocation List adds hash signatures of all GRUB versions that contain the issue. As a result, only secure GRUB versions can boot on the system.

The Revocation List requires regular updates to recognize newly found issues. When updating the Revocation List, make sure to use a safe update method that does not cause your currently installed system to no longer boot.

24.2. Applying an online Revocation List update
Copy link

To prevent known security issues, you can update the Secure Boot Revocation List on your system. This procedure is safe and ensures that the update does not prevent your system from booting.

Prerequisites

  • Secure Boot is enabled on your system.
  • Your system is connected to internet for updates.

Procedure

  1. Determine the current version of the Revocation List: 

    # *fwupdmgr get-devices*

    See the Current version field under UEFI dbx.

  2. Enable the LVFS Revocation List repository: 

    # *fwupdmgr enable-remote lvfs*

  3. Refresh the repository metadata: 

    # *fwupdmgr refresh*

  4. Apply the Revocation List update:

    • On the command line: 

      # *fwupdmgr update*

    • In the graphical interface:

      1. Open the Software application
      2. Navigate to the Updates tab.
      3. Find the Secure Boot dbx Configuration Update entry.
      4. Click Update.
  5. At the end of the update, fwupdmgr or Software asks you to reboot the system. Confirm the reboot.

Verification

  • After the reboot, check the current version of the Revocation List again: 

    # *fwupdmgr get-devices*

24.3. Applying an offline Revocation List update
Copy link

To prevent known security issues on a system with no internet connection, you can update the Secure Boot Revocation List from Red Hat Enterprise Linux. This procedure is safe and ensures that the update does not prevent your system from booting.

Procedure

  1. Identify the current version of the Revocation List: 

    # *fwupdmgr get-devices*

    See the Current version field under UEFI dbx.

  2. List the updates available from RHEL: 

    # *ls /usr/share/dbxtool/*

  3. Select the most recent update file for your architecture. The file names use the following format: 

    DBXUpdate-date-architecture.cab

  4. Install the selected update file: 

    # fwupdmgr install /usr/share/dbxtool/DBXUpdate-date-architecture.cab
  5. At the end of the update, fwupdmgr asks you to reboot the system. Confirm the reboot.

Verification

  • After the reboot, check the current version of the Revocation List again: 

    # *fwupdmgr get-devices*
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top