Dear Linux folks,


On a Dell XPS 15 7590/0VYV0G, BIOS 1.42.0 12/10/2025, Linux warns about:

```
[    0.000000] Linux version 6.19.6+deb14-amd64 
(debian-kernel@lists.debian.org) (x86_64-linux-gnu-gcc-15 (Debian 
15.2.0-14) 15.2.0, GNU ld (GNU Binutils for Debian) 2.46) #1 SMP 
PREEMPT_DYNAMIC Debian 6.19.6-1 (2026-03-06)
[…]
[    0.580291] integrity: Loading X.509 certificate: UEFI:db
[    0.580341] integrity: Loaded X.509 cert 'Dell Inc. UEFI DB: 
5ddb772dc880660055ba0bc131886bb630a639e7'
[    0.580343] integrity: Loading X.509 certificate: UEFI:db
[    0.580367] integrity: Loaded X.509 cert 'Microsoft Corporation UEFI 
CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4'
[    0.580369] integrity: Loading X.509 certificate: UEFI:db
[    0.580391] integrity: Loaded X.509 cert 'Microsoft Windows 
Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53'
[    0.580393] integrity: Loading X.509 certificate: UEFI:db
[    0.580410] integrity: Loaded X.509 cert 'Microsoft UEFI CA 2023: 
81aa6b3244c935bce0d6628af39827421e32497d'
[    0.580412] integrity: Loading X.509 certificate: UEFI:db
[    0.580428] integrity: Loaded X.509 cert 'Microsoft Option ROM UEFI 
CA 2023: 514fbf937fa46fb57bf07af8bed84b3b864b1711'
[    0.582176] blacklist: Duplicate blacklisted hash 
bin:47ff1b63b140b6fc04ed79131331e651da5b2e2f170f5daef4153dc2fbc532b1
[    0.582285] blacklist: Duplicate blacklisted hash 
bin:992d359aa7a5f789d268b94c11b9485a6b1ce64362b0edb4441ccc187c39647b
[    0.582344] blacklist: Duplicate blacklisted hash 
bin:c452ab846073df5ace25cca64d6b7a09d906308a1a65eb5240e3c4ebcaa9cc0c
[    0.582382] blacklist: Duplicate blacklisted hash 
bin:e051b788ecbaeda53046c70e6af6058f95222c046157b8c4c1b9c2cfc65f46e5
[…]
```

Updating the UEFI certificate database(?) does not change this.

How should I address this warning?


Kind regards,

Paul


PS:

```
$ fwupdmgr get-history
[…]
└─UEFI dbx:
   │   Device ID:          362301da643102b9f38477387e2193e57abaa590
   │   Previous version:   20230501
   │   Update State:       Success
   │   Last modified:      2026-03-24 17:04:49
   │   GUID:               4a6cd2cb-8741-5257-9d1f-89a275dacca7
   │   Device Flags:       • Internal device
   │                       • Updatable
   │                       • Supported on remote server
   │                       • Needs a reboot after installation
   │                       • Device is usable for the duration of the update
   │                       • Only version upgrades are allowed
   │                       • Signed Payload
   │                       • Can tag for emulation
   │
   └─Secure Boot dbx Configuration Update:
         New version:      20250902
         Remote ID:        lvfs
         Release ID:       130035
         Summary:          UEFI Secure Boot Forbidden Signature Database
         Variant:          x64
         License:          Proprietary
         Size:             24.1 kB
         Created:          2025-09-02 00:00:00
         Urgency:          High
           Tested:         2026-02-25 00:00:00
           Distribution:   ubuntu 25.10
           Old version:    20230501
           Version[fwupd]: 2.0.18
           Tested:         2026-02-13 00:00:00
           Distribution:   ubuntu 25.10
           Old version:    20230501
           Version[fwupd]: 2.0.17
           Tested:         2025-12-05 00:00:00
           Distribution:   fedora 42 (workstation)
           Old version:    20250507
           Version[fwupd]: 2.0.17
           Tested:         2025-11-10 00:00:00
           Distribution:   fedora 43 (kde)
           Old version:    20230501
           Version[fwupd]: 2.0.16
         Vendor:           Linux Foundation
         Release Flags:    • Trusted payload
                           • Trusted metadata
         Description:
         This updates the list of forbidden signatures (the "dbx") to 
the latest release from Microsoft.

         Some insecure versions of the IGEL bootloader were added, due 
to a security vulnerability that allowed an attacker to bypass UEFI 
Secure Boot.
         Issue:            CVE-2025-47827
         Checksum: 
7178302fa23fcb875e7540900e299fb30a76758663efb7e1c56edc25cd3f316a
```