[Bug]: Windows 11 April 2026 LCU pushed out a new DBXUpdateSVN.bin file

[garlin-cant-code]

Is there an existing issue for this?

• I have searched existing issues

Current Behavior

Windows 11 April 2026 LCU pushed out a new DBXUpdateSVN.bin file, bumping the Windows BootMgr SVN to 8.0. Please provide a copy of the newer file under Post-Signed objects.

Expected Behavior

Post-Signed objects folder to contain the SVN 8.0 version of DBXUpdateSVN.bin

Steps To Reproduce

Run Get-SecureBootSVN from PowerShell.

Build Environment

- OS(s): Windows 11 24H2/25H2 (.8246)
- Tool Chain(s):
- Targets Impacted:

Version Information

Tag: fca1514

Urgency

Medium

Are you going to fix this?

Someone else needs to fix it

Do you need maintainer feedback?

No maintainer feedback needed

Anything else?

No response

[cjee21]

Waiting for updated json and bin files as well.

[garlin-cant-code]

MS greatly reduced the size of April 2026's DBXupdate.bin by removing all of the Microsoft boot manager entries, but accidentally removed three non-MS entries:

[7EAC80A915C84CD4AFEC638904D94EB168A8557951A4D539B0713028552B6B8C] grubx64.efi Canonical 2020-07-01
[804E354C6368BB27A90FAE8E498A57052B293418259A019C4F53A2007254490F] grubnetx64.efi Canonical 2020-07-01
[E7681F153121EA1E67F74BBCB0CDC5E502702C1B8CC55FB65D702DFBA948B5F4] gcdx64.efi Canonical 2020-07-01

Going back to the pre-April 2026 DBXupdate.bin, here's the complete list of Canonical entries for 2020-07-01:

[B93F0699598F8B20FA0DACC12CFCFC1F2568793F6E779E04795E6D7C22530F75] (none) Canonical 2020-07-01
[7EAC80A915C84CD4AFEC638904D94EB168A8557951A4D539B0713028552B6B8C] grubx64.efi Canonical 2020-07-01
[E7681F153121EA1E67F74BBCB0CDC5E502702C1B8CC55FB65D702DFBA948B5F4] gcdx64.efi Canonical 2020-07-01
[804E354C6368BB27A90FAE8E498A57052B293418259A019C4F53A2007254490F] grubnetx64.efi Canonical 2020-07-01

Either someone was trying to remove the entire Canonical group for 2020-07-01 and missed one file -- or they shouldn't have removed the other three because they're not owned by Microsoft?

[garlin-cant-code]

Server 2016 (14393.8957) didn't get a new DBXUpdateSVN.bin, according to 5082198.csv:

5078938.csv:"DBXUpdateSVN.bin","Not versioned","28-Feb-2026","07:14","3,509"
5078938.csv:"DBXUpdateSVN.bin","Not versioned","28-Feb-2026","06:12","3,509"
5082198.csv:"DBXUpdateSVN.bin","Not versioned","13-Apr-2026","02:46","3,509"
5082198.csv:"DBXUpdateSVN.bin","Not versioned","13-Apr-2026","02:24","3,509"

[cjee21]

MS greatly reduced the size of April 2026's DBXupdate.bin by removing all of the Microsoft boot manager entries, but accidentally removed three non-MS entries:

The x86 one has entries removed for no apparent reason previously as well according to #375

[cjee21]

Since the JSON here is not updated yet, this is the hash that is added in April for x64:

              {
                "authenticodeHash": "D013BA511AEE89BA3285D1CAC0C9F4F21EF4810873C2EBBFFE7712BF0BE8CED3",
                "hashType": "SHA256",
                "flatHash": "926BB1A08E1427AB7E14587955D451A8A05808BE609C92CB74668B0828DD8CE1",
                "filename": "shdloader.efi",
                "description": "EasyFix tool from EAZ solutions",
                "companyName": "EAZ Solutions",
                "dateOfAddition": "2025-12-23",
                "signingAuthority": "CN = Microsoft Corporation UEFI CA 2011"
              }

Source: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\SecureBoot\hashes.json

[SochiOgbuanya]

olkorsha, FYI

[pbatard]

I guess aef8c75 is closing this issue.

But considering that I already reported a similar lack of coordination between Microsoft and Microsoft when it comes to SVN updates in #255, which clearly hasn't been addressed, since it took another one month for this repository to actually reflect the SVN update, can I ask that the people who manage this repository please, please, PLEASE contact the people who are in charge of pushing the SVN updates through Windows Updates, so that they make it a mandatory item on their checklist, every time they do update the SVN, to provide that update to you guys.

The SVN affects more than just Windows users (since a vulnerable bootmgr could be used to install malware on a Secure Boot enabled Linux environment) and this repository is the UEFI reference for updated Secure Boot databases, so it is quite inconceivable that it should lag one month behind when it comes to critical updates like the SVN.

So, please, Microsoft, coordinate better between your teams. As a matter of fact, IMO, because of the above, you should make it a point that a Windows Update cannot push an SVN update to users until this repository has first been updated for that SVN, as the UEFI root for Secure Boot databases should always be the first and foremost authority in that matter.

So, can we have coordination between Microsoft teams at long last? Or will we need to create yet another issue when SVN v9.0 gets pushed by the Windows Update team, and have to wait for yet another extra month to see the authoritative Secure Boot directory reflect the latest changes in the Secure Boot databases.

Thank you.

[cjee21]

It's not just SVN. The April update added one hash to DBX and removed many. Until now, we still do not have the update here, no public documentation of the added hash, and do not know why so many hashes were removed.