Hi everyone,
I wasn't sure if I should start a whole new post (I noticed there were a few others), but I have the same exact issue with updating SecureBoot dbx. I also have outputs to provide. I hope it helps.
Manual system changes:
- (Maybe most relevant?) I enrolled the Nvidia driver with mokutil (the Software Updater did get the driver though).
- I disabled Wayland for all users to stop login screen glitchiness (using Xorg/X11 -- I don't know the difference).
- To fix Intel display glitchiness when the mouse is in a certain y line on the screen, I set a startup Kernel cmd to:
- I made the swap file bigger 8GB I think.
- I turned off Intel Turboboost in rc.local
- "echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo"
I also have the exact same update failure situation on a Lenovo Legion 5 Pro, also with an Nvidia card I MOK enrolled, but here are the outputs on my ASUS.
Updated packages
I made sure that I had all of the updates from the Software Updater.
Trying to install it from the Software "Updates" menu:
On reboot, the Software "updates" menu says:
"Detailed errors from the package manager follow:
failed to build result for 362301da643102b9f38477387e2193e57abaa590"
The four terminal commands:
sudo fwupdmgr refresh --force
[sudo] password for username:
Updating lvfs
Downloading… [***************************************]
Downloading… [***************************************]
Successfully downloaded new metadata: 2 local devices supported
sudo fwupdmgr get-updates
[sudo] password for username:
Devices with no available firmware updates:
• SD8SN8U512G1002
• System Firmware
Devices with the latest available firmware version:
• Unifying Receiver
Devices that were not updated correctly:
• UEFI dbx (466 → 20241101)
Uploading firmware reports helps hardware vendors to quickly identify failing and successful updates on real devices.
Upload report now? (Requires internet connection) [Y|n]:
n # did y for this the first time
Do you want to disable this feature for future updates? [y|N]:
n
Declined upload
sudo fwupdmgr update
[sudo] password for username:
Devices with no available firmware updates:
• SD8SN8U512G1002
• System Firmware
╔══════════════════════════════════════════════════════════════════════════════╗
║ Upgrade UEFI dbx from 466 to 20241101? ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ This updates the list of forbidden signatures (the "dbx") to the latest ║
║ release from Microsoft. ║
║ ║
║ An insecure version of Howyar's SysReturn software was added, due to a ║
║ security vulnerability that allowed an attacker to bypass UEFI Secure Boot. ║
║ ║
║ UEFI dbx and all connected devices may not be usable while updating. ║
╚══════════════════════════════════════════════════════════════════════════════╝
Perform operation? [Y|n]: y
Downloading… [***************************************]
Decompressing… [***************************************]
Decompressing… [***************************************]
Authenticating… [***************************************]
Authenticating… [***************************************]
Restarting device… [***************************************]
Writing… [***************************************]
Decompressing… [***************************************]
Writing… [***************************************]
Restarting device… [***************************************]
Waiting… [***************************************]
Successfully installed firmware
Devices with the latest available firmware version:
• Unifying Receiver
An update requires a reboot to complete. Restart now? [y|N]: n # I did reboot after all four commands.
sudo rm /var/lib/fwupd/pending.db
[sudo] password for username:
# Rebooted, update still present (in Software) and not installed successfully.
Tried installing it (again) via Software updater, rebooted, got these outputs:
fwupdmgr get-devices
P2440UQ
│
├─SD8SN8U512G1002:
│ Device ID: 64ec4cd1e1c9565e79b00f4e7221b1c689b33e96
│ Summary: ATA drive
│ Current version: X4131002
│ Vendor: SanDisk (ATA:0x15B7, OUI:001b44)
│ GUIDs: 17a85366-6316-503f-a203-624f1c655533
│ d5aaa1ea-cb09-56e9-919a-5f1f3c94e577
│ 49cface8-ecaf-520e-9634-30df19a60a47
│ Device Flags: • Internal device
│ • Updatable
│ • System requires external power source
│ • Needs a reboot after installation
│ • Device is usable for the duration of the update
│
├─System Firmware:
│ │ Device ID: a45df35ac0e948ee180fe216a5f703f32dda163f
│ │ Summary: UEFI ESRT device
│ │ Current version: 803
│ │ Minimum Version: 803
│ │ Vendor: ASUSTeK COMPUTER INC. (DMI:ASUSTeK COMPUTER INC.)
│ │ Update State: Success
│ │ GUIDs: 180bd2b6-7155-5cd1-8104-386e542c22b0
│ │ 230c8b18-8d9b-53ec-838b-6cfc0383493a
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Needs a reboot after installation
│ │ • Device is usable for the duration of the update
│ │
│ └─UEFI dbx:
│ Device ID: 362301da643102b9f38477387e2193e57abaa590
│ Summary: UEFI revocation database
│ Current version: 466
│ Minimum Version: 466
│ Vendor: UEFI:Linux Foundation
│ Install Duration: 1 second
│ Update State: Needs reboot
│ Last modified: 2025-06-17 16:08
│ GUIDs: 6c9777b8-19f2-5e2c-9210-66ef3691a9f3
│ c8749f7f-439b-5c3c-a2ea-3baacf663a5a
│ c6682ade-b5ec-57c4-b687-676351208742
│ f8ba2887-9411-5c36-9cee-88995bb39731
│ 7d5759e5-9aa0-5f0c-abd6-7439bb11b9f6
│ 0c7691e1-b6f2-5d71-bc9c-aabee364c916
│ Device Flags: • Internal device
│ • Updatable
│ • Supported on remote server
│ • Needs a reboot after installation
│ • Only version upgrades are allowed
│ • Signed Payload
│
└─Unifying Receiver:
Device ID: 5859fae972cb36551b299175761b33d8e6e7ce02
Summary: Miniaturised USB wireless receiver
Current version: RQR12.11_B0032
Bootloader Version: BOT01.04_B0016
Vendor: HIDRAW:0x046D|USB:0x046D
Install Duration: 30 seconds
GUIDs: 9d131a0c-a606-580f-8eda-80587250b8d6
fcf55bf5-767b-51ce-9c17-f6f538c4ee9f
279ed287-3607-549e-bacc-f873bb9838c4
Device Flags: • Updatable
• Supported on remote server
• Signed Payload
Bonus debug command
fwupdmgr get-history
P2440UQ
│
└─UEFI dbx:
│ Device ID: 362301da643102b9f38477387e2193e57abaa590
│ Previous version: 466
│ Update State: Failed
│ Update Error: failed to run update on reboot
│ Last modified: 2025-06-17 16:24
│ GUID: 6c9777b8-19f2-5e2c-9210-66ef3691a9f3
│ Device Flags: • Internal device
│ • Updatable
│ • Supported on remote server
│ • Needs a reboot after installation
│
└─Secure Boot dbx:
New version: 20241101
Remote ID: lvfs
Release ID: 108324
Summary: UEFI Secure Boot Forbidden Signature Database
Variant: x64-compat
License: Proprietary
Size: 23.3 kB
Created: 2023-05-09
Urgency: High
Vendor: Linux Foundation
Duration: 1 second
Release Flags: • Is upgrade
Description:
This updates the list of forbidden signatures (the "dbx") to the latest release from Microsoft.
An insecure version of Howyar's SysReturn software was added, due to a security vulnerability that allowed an attacker to bypass UEFI Secure Boot.
*Edited for Markdown formatting and then to include the whole UEFI dbx id in Software output.
Thank you for your help,
ChronosJ
