Fwupd 2.1.7 has been released to address a significant trust-boundary vulnerability that allowed unsigned metadata to bypass authorization checks during firmware installations, enhancing UEFI update security. This update also introduces a systemd-pcrlock plugin, expands attributes for the Hardware Security Index (HSI), and resolves several memory safety issues. Users are encouraged to enable the OnlyTrusted metadata enforcement toggle for enterprise environments, while desktop users will benefit from improved D-Bus authorization and HSI scoring. The rapid pace of updates reflects the increasing security demands in the Linux firmware landscape, driven by supply chain pressures and the need for more robust security measures

Fwupd 2.1.7 Patches Critical Linux Firmware Flaw, Hardens UEFI Updates

Fwupd 2.1.7 is now live, closing a trust-boundary vulnerability that let unsigned metadata bypass authorization checks during firmware installations. The release pairs that security patch with a new systemd-pcrlock plugin for UEFI updates, expanded Hardware Security Index attributes for SPI flash and disk encryption, and fixes for several memory safety flaws in core plugins. Enterprise deployments should prioritize the OnlyTrusted metadata enforcement toggle, while desktop users will benefit from tighter D-Bus authorization and a cleaner HSI scoring report. Rolling out across all major Linux distributions starting today, the update is the latest in fwupd's accelerated mid-2026 hardening cycle driven by supply-chain pressure and AI-assisted static analysis.

Fwupd 2.1.7 Patches Critical Linux Firmware Flaw, Hardens UEFI Updates @ Linux Compatible