kbal , 11 hours ago (edited 9 hours ago)

Update: According to various indications around the net it turns out that the problem (for Debian users at least) is not grub at all, it's shim itself. They did update the grub SBAT level in a way that should satisfy Microsoft's demands when they patched the CVE that everyone seems to be pointing to as the one Microsoft was aiming for.

What they didn't do in time is update shim (possibly related to CVE-2022-28737, I'm not sure.) There is a new version which has the required change but it has not yet made it to Debian stable. Microsoft added an SBAT for shim as well (which gets checked by shim, so if it's broken... uh... anyway, it's probably fine) and it's the one causing the problems.

(Edited to reflect that I don't really know if it was the fix for CVE-2022-28737 that was needed, the SBAT variable update related to that, or something else. Whichever it is, the shim update currently in the bookworm proposed updates queue should have it.)