Ubuntu 26.10 Looks To Strip Its GRUB Bootloader To The Bare Minimum For Better Security
Ubuntu developers at Canonical are looking to strip the signed GRUB bootloader features to the bare minimum for the Ubuntu 26.10 release later this year. Dropping support for XFS, ZFS, Btrfs, LVM, md-raid (except RAID1), LUKS-encrypted disks, and other features is being looked at in the name of security.
Due to various parsers and other features being a "constant source of security issues" with the GRUB bootloader, Ubuntu 26.10 is likely to remove a lot of features from the signed GRUB builds necessary for Secure Boot support. This would include removing GRUB's support for the Btrfs, XFS, and ZFS file-systems, among others. It would also remove support for the Logical Volume Manager (LVM), remove md-raid except RAID1, and also remove support for LUKS-encrypted disks.
These file-systems and features like LVM and LUKS-encrypted disks would still be supported by Ubuntu itself but not the default signed GRUB bootloader. Ripping out all of these GRUB features would basically mandate that most Ubuntu 26.10+ installations are done with the /boot partition being done on a raw EXT4 partition. Thus no more encrypted boot partition and having to rely on an EXT4 boot partition even if you are a diehard Btrfs / XFS / OpenZFS fan. Or you could opt for the non-signed GRUB bootloader that would be more full-featured albeit lacking Secure Boot and security compliance.
Reducing the signed GRUB builds to the minimum support necessary they feel would "[substantially] improve security". Users wanting those features back could use the non-signed GRUB builds albeit losing out on UEFI Secure Boot and security support. The Ubuntu 26.04 LTS upgrader would disable upgrades for those using such functionality currently with their boot configuration to avoid breakage when Ubuntu 26.10 is available.
More details on these planned signed GRUB changes for Ubuntu 26.10 via the Ubuntu Discourse.
Due to various parsers and other features being a "constant source of security issues" with the GRUB bootloader, Ubuntu 26.10 is likely to remove a lot of features from the signed GRUB builds necessary for Secure Boot support. This would include removing GRUB's support for the Btrfs, XFS, and ZFS file-systems, among others. It would also remove support for the Logical Volume Manager (LVM), remove md-raid except RAID1, and also remove support for LUKS-encrypted disks.
These file-systems and features like LVM and LUKS-encrypted disks would still be supported by Ubuntu itself but not the default signed GRUB bootloader. Ripping out all of these GRUB features would basically mandate that most Ubuntu 26.10+ installations are done with the /boot partition being done on a raw EXT4 partition. Thus no more encrypted boot partition and having to rely on an EXT4 boot partition even if you are a diehard Btrfs / XFS / OpenZFS fan. Or you could opt for the non-signed GRUB bootloader that would be more full-featured albeit lacking Secure Boot and security compliance.
Reducing the signed GRUB builds to the minimum support necessary they feel would "[substantially] improve security". Users wanting those features back could use the non-signed GRUB builds albeit losing out on UEFI Secure Boot and security support. The Ubuntu 26.04 LTS upgrader would disable upgrades for those using such functionality currently with their boot configuration to avoid breakage when Ubuntu 26.10 is available.
More details on these planned signed GRUB changes for Ubuntu 26.10 via the Ubuntu Discourse.