Can't boot to Windows 11 from GRUB menu with Secure Boot enabled (dual boot)

Ask Fedora
, ,
1

Hello!

So, GRUB itself and Fedora 44 KDE boot fine, and mokutil --sb-state says SecureBoot enabled.

But when I try to boot to Windows 11 from GRUB, the first time it does nothing and returns to GRUB menu, and the second time it shows this error:

r/Fedora - Can't boot to Windows 11 from GRUB menu with Secure Boot enabled (dual boot)|750xauto

Then after pressing enter Windows boots normally, and Secure Boot works there too (according to Windows Security).

On the BIOS, CSM and Fast Boot are disabled, I already tried resetting the default Secure Boot keys, and on Windows Fast Startup and Hibernation are disabled too. If I disable Secure Boot then everything works fine, but some games I play require Secure Boot to be enabled.

One interesting thing: on /etc/default/grub, if I set GRUB_TERMINAL_OUTPUT to "gfxterm", then the error changes, instead it says “Security Policy Violation” and the only way to get out is by pressing Ctrl+Alt+Del to restart my PC. The picture above is with Fedora’s default, GRUB_TERMINAL_OUTPUT="console".

Another strange thing: after selecting Windows Boot Manager in GRUB for the first time, when it does nothing and shows GRUB again, if instead of choosing Windows again (which then shows the error mentioned above) I instead choose Fedora, I get a different error:

r/Fedora - Can't boot to Windows 11 from GRUB menu with Secure Boot enabled (dual boot)|750xauto

Booting to Windows from the motherboard’s F11 menu also works fine, so the problem is between GRUB and Windows. I’ve been dealing with this since May, hoping an update fixes it, but nothing happened so far, and I don’t even see any bug reports about this either. I already tried reinstalling Fedora as well (even cleaning the EFI partition and everything), but it didn’t fix my issue. I don’t know what else I can try. Both Fedora and Windows are fully up to date.
I already tried reinstalling GRUB2 following the Quick Docs, but no success. I can’t reproduce the issue on Kubuntu 26.04 when I tried it on this same computer, so it’s clearly an issue with Fedora’s GRUB implementation.

Motherboard: ASRock B850M Pro-A WiFi, BIOS 4.43.
CPU: AMD Ryzen 5 9600X
GPU: AMD Radeon RX 9060 XT (open source drivers)

2

There have recently been issues noted with systems using kde and having the RX 9050 or 9060 GPUs when using the 7.1.6 kernel.

Your issue might be related.
This is one example

3

Luckily I don’t have any artifacts anywhere so far. And my boot issue didn’t start with kernel 7.1.6, problems started around May. I doubt it’s kernel related, since Fedora boots and works fine, it’s GRUB that can’t load Windows 11 with Secure Boot enabled, and considering the GRUB from Kubuntu can, then I figure it might be something in the way Fedora customizes GRUB that’s incompatible with my PC (since I haven’t seen anyone else having this issue).

4

I have a suspicion that we need to get used to not being able to boot windows from grub when secure boot is enabled. By using the TPM, the windows system can detect if it being booted directly from UEFI or indirectly through some other boot loader. I’ve seen suggesting that instead of chainloading the windows boot loader, grub should just set the boot-next flag and then do a system reset. systemd-boot has experimental code to exactly that.

I could also imagine that the GNOME reboot function could be augmented with a facility to set the boot-next flag so instead of booting GNOME it would then boot the alternative OS.

I apologize that this is not an answer you are looking for