Fwupd 2.1.7 Ships to Patch Trust-Boundary Bypass and Harden UEFI Update Flows
The July 27 release adds HSI scoring for SPI flash locks and TCG disk encryption, integrates systemd-pcrlock into BIOS update paths, and closes a recently disclosed D-Bus install flaw.
Richard Hughes has pushed fwupd 2.1.7, closing a trust-boundary flaw that let unsigned metadata slip past authorization checks during firmware installs. The update also adds new Hardware Security Index attributes for SPI flash locks and TCG disk encryption, hooks systemd-pcrlock into UEFI update flows, and patches several memory safety issues that had been sitting in the wild.
The 2.x branch has been fwupd's deliberate push toward a hardened security model. It trades the older C-heavy plugin architecture for a Rust migration, stricter Polkit checks, and a structured scoring system that tracks 49 distinct hardware security attributes. This release keeps that momentum going. It's the second fwupd jump in July 2026, following 2.1.6 on the first, and it reads less like a feature drop and more like a security sweep.
The trust-boundary flaw
The headline fix addresses a vulnerability documented as GHSA-9f42-c37j-25jh. Security researcher Daniel Birtwhistle at GE HealthCare found that fwupd's D-Bus install path was consuming unsigned metadata before the OnlyTrusted enforcement ran. That timing gap let a local unprivileged user tweak version tags to skip prompts, mutate device state with rejected archives, and retarget signed payloads to sibling emulator modules by editing unsigned GUID fields. The patch in 2.1.7 defers metadata consumption until trust validation finishes and blocks force installs over D-Bus entirely.
Keep in mind that the flaw mainly affects systems running OnlyTrusted=false, which remains the default on most distributions. However, at the same time, the same researcher confirmed that the FORCE flag mechanism allowed an unprivileged user to skip version_lowest checks. That's a related hardening issue, but it compounds the attack surface if you run the daemon as a standard service.
Memory safety and D-Bus hardening
Hughes also squashed several memory safety issues that could've become data leaks or corruption vectors. There's a heap over-read in DFU sector parsing, an out-of-bounds access in Synaptics RMI responses, a bounds-check gap for PixArt touchpad writes, and an EFI capsule offset validation that didn't account for section sizes. A TOCTOU race in memfd handling got patched by copying file descriptor contents before use instead of racing the kernel.
These aren't theoretical. The DFU and Synaptics bugs sit in plugins that see daily use across thousands of laptops and tablets. Bounding those reads is exactly why the Rust migration matters. The 2.x branch has been incrementally rewriting C plugins to eliminate buffer overflows and use-after-free bugs that historically produced the majority of fwupd CVEs.
New security attributes and systemd-pcrlock
On the feature side, fwupd now tracks "well known" AppStream IDs for common BIOS toggles like Secure Boot and TPM state, so HSI reports can flag when those settings get flipped to their insecure defaults. A new systemd-pcrlock plugin locks post-UEFI-update systems to bootloaders measured into specific TPM PCR values, killing rollback and unauthorized boot code execution in the same breath. There's also out-of-band EFI signature list support for enterprise MDM tools like Intune, and fresh HSI attributes for MTD hardware write-protect and TCG Opal disk encryption status.
The release also rounds out the usual maintenance queue. Dropped status updates during active installs are fixed, along with a polkit regression in fwupd-refresh.service, a Logitech HID++ segfault, suspend-to-ram conflicts with AMD SME and Intel TXT, and a few PixArt/CCGX bounds checks that refused to validate before indexing version arrays. The Coreboot VBOOT logic for HSI scoring got corrected too, which should stop devices from falsely reporting BootGuard as obsoleted.
If you've been following the project, the mid-2026 cadence has been unusually aggressive. Two releases a month, with the previous 2.0.21 stable backport explicitly calling out 250-plus fixes from AI security scanners. That's a reflection of how supply-chain pressure has forced upstream Linux firmware tooling to behave like enterprise security products rather than convenience daemons. The 2024 Passim binding controversy didn't help the image, but the 2.x branch has been quietly tightening the ship ever since.
Head here to download the release from GitHub. If you're running an enterprise setup, flipping OnlyTrusted=true and evaluating the new systemd-pcrlock plugin for your UEFI workflow will pay dividends. Even home users should grab this one. Run fwupdmgr get-hsi-report afterward to see what your machine's actual security posture looks like under the new metrics.
