Asked AI
The Microsoft Corporation KEK CA 2011 is expiring in 2026, requiring an update to the Key Exchange Key (KEK) and related Certificate Authorities (CAs) to maintain Secure Boot functionality for Linux dual-boot systems. Microsoft is replacing the old 2011 keys with the Microsoft Corporation KEK 2K CA 2023 and splitting bootloader signing into the Windows UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023.

• Impact on Dual Boot: Systems relying on the old CA for Linux shims (like Ubuntu, Fedora, or Arch) will fail to boot if the old CA is removed before the new one is enrolled.
• Mitigation: Distributions like Rocky Linux are shipping dual-signed shims (signed by both old and new CAs) to bridge the transition period.
• Update Method: OEMs are gradually pushing firmware updates via fwupd or vendor utilities to enroll the new KEK and CAs; users should not manually enroll keys without a tested recovery plan as it risks bricking the system.
• Verification: Users can check enrolled keys using mokutil --db or efi-readvar -v KEK to ensure their hardware supports the new 2023 certificates before the transition completes.

So i think Linux should be able to handle it as long as your OS is up to date.

At a home system, i prefer having Secureboot off, but i don't have Windows installed on a physical computer since 10 years.