Libreboot 26.11 “Rubber Duck” released! With full UEFI support.

Return to index

Article published by: Leah Rowe

Date of publication: 12 November 2026

• <<
• < Prev
• >>

You can find today’s release in https://rsync.libreboot.org/stable/26.11/ or you can use one of the mirrors.

Libreboot is free, open source boot firmware replacing proprietary BIOS/UEFI firmware on supported Intel/AMD and ARM64 hardware. It initialises the hardware inside your computer such as the CPU or memory controller, configuring the machine in such a way as to enable use of an operating system like Linux or BSD at boot - and now Microsoft Windows is also compatible because Libreboot has added full UEFI support via MrChromebox EDK2 payload. Libreboot offers greater security and customisation compared to proprietary firmware; its goal, plainly, is to rid the world of proprietary software and to do that, we therefore try to provide firmware that is extremely easy for non-technical users to understand.

Today’s release changelog is relative to the previous Libreboot 26.10 release. Please note that some of the changes were also present in revisions to 26.10, but this changelog is relative to the original 26.10 release, for safety.

Boards that use EDK2 UEFI payload now only use EDK2 UEFI payload. Users urged to switch fully to UEFI in existing OS installs, with full ESP; consult your OS documentation.

Legacy usage still possible (GRUB, SeaBIOS) using the guidance here:

Re-adding legacy payloads to Libreboot EDK2.

OF NOTE: The CSM module for EDK2, as documented there, is ReBIOS which offers much improved VGA emulation over traditional SeaBIOS or the previously used CSMWrap payload. Actual legacy BIOS-based operating systems work now. For example, DOS games might actually work in FreeDOS. ReactOS and Windows XP were tested - more notes provided below.

Users warned to please adapt their OS installs to UEFI before installing this new release. This same change was made in the corresponding RBoot 26.11 release, codename “Iodine” - formerly known as Canoeboot. This is maintained by the same developer, Leah Rowe, and it was established recently for the specific purpose of proposing RBoot to the GNU project. RBoot is Leah Rowe’s deblobbed fork of Libreboot, with much lower hardware support than Libreboot, but intended for Free Software diehards who don’t mind having slightly broken and/or outdated hardware.

• Made the anti-AI policy in the AGENTS file even more persuasive about the perils of generative AI. Still the most important feature.

• MemTest86plus payload removed - see notes below.
• GRUB payload supporm removed - see notes below.
• CSMWrap payload replaced with ReBIOS, but it is not built in lbmk - see notes below.
• CSMWrap payload removed on EFI - buggy. Too buggy.

OF NOTE: ReBIOS CSM module tested with EDK2, and it was able to boot ReactOS! Unlike SeaBIOS’s SeaVGABIOS implementation, ReBIOS implements its own full VGA BIOS emulation and it works perfectly with legacy VGA modes. Windows XP also tested on a ThinkPad X220. We can now actually use legacy BIOS-based operating systems in Libreboot, using ReBIOS, but note that VT-d or AMD equivalent is required (IOMMU) as it runs inside a hypervisor with hardware passthrough; this enables operating systems to use real drivers, while it provides INT10h services (VGA) and everything else required in a BIOS. ReBIOS is based on CSMWrap and uses its own heavily modified fork of SeaBIOS as the core - not included in releases, but see notes below. Users wanting to run old operating systems can do it easily, using ReBIOS added to EDK2. Please read the notes below (they also cover GRUB and MemTest86).

NOTES:

Boards using EDK2 are EDK2-only in this release, with iPXE optionally. Users can re-add GRUB EFI, ReBIOS (SeaBIOS CSM) and MemTest86plus to EDK2 using a generalised feature in lbmk: place grub.efi, mt86plus.efi and rebios.efi in efi/ in lbmk, when compiling. If the board uses EDK2, any images mentioned here will be added. Not all required; for example, you could just add rebios.efi.

Libreboot lbmk no longer builds these legacy payloads, but the documentation was updated to tell the user how to build them, or get builds from upstream. The user inserts them by recompiling Libreboot in this new scheme, described in the document:

Inserting legacy payloads in Libreboot EDK2

Please do note: GRUB-coreboot also removed (the coreboot payload). A minority of legacy 32-bit-only Intel/AMD boards still use SeaBIOS. One or two boards that could run EDK2 still use SeaBIOS, because they start with textmode via VGA ROM or libgfxinit; unknown if EDK2 could work (linear framebuffer).

Nearly all boards in Libreboot ship now with just EDK2. This is a simple, conservative default and it is now the responsibility of the user to maintain their own use of the legacy payloads if they wish. Users are advised to upgrade their existing OS installs to full UEFI. Please consult the documentation for your operating system. Libreboot is now boring, conservative UEFI firmware. Libre UEFI firmware. The only one of its kind, at the scale that Libreboot exists at, and will exist at, in ongoing and upcoming development - going EDK2 allows many new feature changes; for example, Kabylake ThinkPads now enable TPM 2.0 by default, which was unstable in SeaBIOS but works perfectly in EDK2.

• Briefly tested CrabEFI as an experimental UEFI payload, but it was later scrapped as EDK2 is still the best choice.
• Always tar coreboot ROMs when building, even in non-release mode, but the non-release mode does not nuke vendor files. This makes running the build again much easier, for changing MAC addresses or injecting new MAC addresses.

• EDK2 enabled by default in coreboot mkhelper; overridden by disablement per target/tree, like when replacing with SeaBIOS or U-Boot. This allowed to remove payload handling in most targets, as the intended default is used on most boards anyway. Payload handling is much simpler now, in lbmk (this was done when making EDK2 boards EDK2-only, after removing the GRUB payload for example). FAM15h trees also simplified: seabios configured in the tree, rather than per target, as all targets there use SeaBIOS.
• Dependencies (lbmk): Use 7zip instead of p7zip, zlib-ng instead of zlib. More modern. zlib-ng is much faster - patch courtesy of Ronanand on IRC.
• MrChromebox coreboot sources added to releases, but images are still release n, which means that if someone wants to sell a Libreboot Chromebook for example, they now have an easy way to acquire and distribute the complete corresponding source code. Please note that the released source code doesn’t build, because it excludes several blob repositories as the files in those repositories may be somewhat dubious legally speaking; work will be done in a future release to support adding and removing these using ./mk inject, which would allow distributing firmware images while still avoiding the distribution of these additional files. The sources provided are largely the upstream coreboot sources, plus modifications made by MrChromebox. They have been audited heavily, long before MrChromebox was even added to Libreboot - auditing of the entire MrChromebox project began in early 2025!
• Prefix bios_ or uefi_ to ROM image filenames (coreboot), making it clearer which is which: U-Boot and EDK2 are uefi and SeaBIOS is bios.
• Set release n/untested on ASUS KFSN4-DRE - this board was later removed, for this release.
• Disabled experimental EDK2 support on ASUS Fam15h boards as more plumbing needed first in 15h.org coreboot - SMMSTORE driver for instance. These boards all use SeaBIOS in Libreboot 26.11. (pure SeaBIOS, without GRUB)
• Merged BIOS- and UEFI-based coreboot targets into single targets, because UEFI targets later became UEFI-only!
• Removed untested purism boards from MrChromebox code import
• Deleted board: e6400nvidia (intel version remains)
• Removed text-mode startup on i945 thinkpads because it doesn’t work in the recently added libgfxinit code there - only corebootfb works.
• Briefly re-added text mode configs on boards where EDK2 was added, and added back support for bare SeaBIOS/SeaGRUB - later removed again. Ditto keymapped SeaGRUB images.
• New naming scheme for ROMs: vendor_model_variant_sizeofflash - backward compatibility added so that old target names can be used for builds.
• Removed all GRUB modules pertaining to native coreboot drivers on EFI GRUB; on EFI GRUB, a lot of functionally piggybacks off of EDK2 drivers.
• Use EDK2 payload on Dell OptiPlex 780 variants.
• Marked acer q45t am release n, untested - later deleted entirely.
• Marked e6400nvidia board release n, untested - later deleted entirely.
• Marked Gigabyte GA-G41m-ES2L as release=n (untested) - later deleted entirely.
• Updated Arch Linux dependencies
• Add Libreboot to coreboot LOCALVERSION to let upstreams know a coreboot log is from Libreboot. This makes confusion with upstream less likely, when users report bugs upstream. This was done, after much-heated discussion.

• Enabled TPM 2.0 by default, on Topton X2e N150, Supermicro X11SSH-F, ThinkPad X280, ThinkPad X270, ThinkPad T480/T480s and ThinkPad T580. This was disabled before, due to bugs in the SeaBIOS driver, but we now only use EDK2 on these boards and it works perfectly there. This enables use of bitlocker for example in Windows, though it should be noted that the TPMs are discrete on these boards and thus the data could be sniffed on the board (keys and such) using several known methods - TPM is security theatre, unless it’s verifiably secure (open source code, fully audited) and deeply embedded into a processor; discrete TPM is always unsecure. TPM 2.0 was thus not enabled for security reasons; it was enabled for compatibility reasons. Several use cases demand that it be enabled. TPM 1.2 was not enabled anywhere, because this is mostly pointless nowadays as SHA-1 is not secure.
• FD size limit set to 32MB in EDK2, vastly higher than the default, to allow much more code to be added. This is useful for adding GRUB or Linux payloads into EDK2, as per user configuration.
• efi/ directory in lbmk: insert any combination here of grub.efi, and rebios.efi or mt86plus.efi - when building EDK2-based targets, these will be added to EDK2. This is skipped on release builds. This lets users re-add payloads easily, in their own builds. Information about this is included in the documentation. Libreboot is EDK2-only now in release builds, on targets that use EDK2. SeaBIOS targets (several legacy 32-bit boards) are SeaBIOS-only. Payloads have been vastly simplified as a result of this.
• ./mk release - allow skipping binary builds. Do ./mk release src and it will only generate the src tarball. This is useful for people distributing modified firmware on computers, where they just want to distribute source code. (useful for Libreboot resellers)
• cpbin=y - set this in target configs to support copying and creating tar archives out of builds from elf/ on a per-target basis, copying the tarball into bin. This was put to use for PCSX-Redux OpenBIOS, Pico Serprog and STM32 vserprog firmware releases. That is to say: image release tarball creation is more generalised across projects. The coreboot logic is still custom, but creates tarballs along the same scheme. Tarballs named thus: libreboot-VERSION_project_targetname - coreboot images omit coreboot in the name, for this release.
• Use defconfigs on coreboot and U-Boot - as in the last release, but it was cleaned up a lot. A few targets e.g. cros rk3399 chromebooks, still needed to be presented as full configs due to idiosyncrasies in the coreboot build system regarding payload configuration on ARM64.
• Added backward compatibility to ./mk inject: old target names now work, and dummy (nobin=y, release=n) targets added for ThinkPad T440p/W541 MRC targets to allow insertion of legacy MRC on old ThinkPad Haswell images - now the modern lbmk revisions can inject vendor files in Libreboot releases going all the way back to 20221214. This was done because building sources for utils on older releases would likely make build errors. Backward compatibility is essential, if the user simply wants to inject files in older releases. Please note that E6400 VGA support is still gone, because Nvidia E6400 latitude variants were always buggy and worthless to even own, due to bad hardware design and buggy nouveau drivers.
• Skip copying coreboot ROM to bin/ if a target.cfg file for the board specifies nobin=y, because some targets are not intended for general use. This was turned on for the dummy edk2 coreboot targets.
• Randomise MAC addresses by default on Intel IFD setups where GbE region is used, when building coreboot images. This is skipped on release builds. Boards can disable MAC address changing by setting skip_gbe_cook=y in the target.cfg file per board.
• SATA hotplug enabled on Dell OptiPlex 5050 SFF, courtesy Ron Nazarov.
• Removed E6400 VGA support on ./mk inject because E6400 Nvidia support was removed. We now only support the Intel GPU variant. The Nvidia variant was always buggy and never booted reliably on any operating system.
• Renamed Chromebooks: cros_vendor_model instead of mrchromebox_model_vendor_uefi to avoid confusion as although the code is MrChromebox, equating Libreboot with upstream might have otherwise caused users to erroneously report bugs upstream. GRU chromebooks also renamed thus: cros_rk3399_gru_bob and cros_rk3399_gru_kevin.
• Memtest86plus 32-bit used in releases on 32-bit boards - Memtest later deleted, for the user to re-add via build option (build from source).

• ./mk crosinfo - list chromebook models. Will we re-added as necessary, in a branch, for the next Chromebook update. It makes a Markdown page for the Libreboot website, listing Chromebooks in coreboot.
• ./mk import_uboot - import defconfigs from U-Boot, converting to lbmk setup and setting up cross compilers. It works, but actual boards need testing so just having them all in the tree is pointless for now. Will re-add when these are tested. It is a future ambition of Libreboot to become a U-Boot distro, automatically importing and reconfiguring various boards for our purposes. It currently mostly just focuses on coreboot, but U-Boot itself provides initialisation on several thousand boards.

• Nuke function: nuke files as per nuke.list per project tree, on regular downloads in lbmk and on releases. Previously only on releases. This brings parity with release builds, and confusion can be eliminated by just commiting the deletions before adding new patches for testing, being careful to avoid including the deletion patch. It used to be that when building in lbmk, we would make sure never to use files that got deleted in release builds. This change eliminates all doubt.
• Fixes hashes for Topton X2E N150 boards: in the initial 26.10 release, FSPS was inserted twice as also FSPM; this bricked the build, and made vendor injection fail. This was also fixed in a revision to the 26.10 release.
• Only clean sources BEFORE rebuilding, in lbmk, not after. This reduces waste of computational resources, as we only need to clean once, before a build. We don’t re-use artifacts between builds, but we cache complete builds and re-build on the basis of changes to project metadata in config/ - simpler and easier to maintain, and in practise doesn’t cause many performance issues. This is because Libreboot’s design makes tracking such artifacts a bit harder, so we just nuke everything before each build.
• Added Libreboot version in coreboot dmi data, and coreboot log, to help upstreams identify when Libreboot users report bugs. This enables them to more reliably ignore such reports, or send users back downstream - this was done, after much-heated discussion with a well-respected comrade in the free software movement.
• Backported an EDK2 bugfix allowing SD card readers to work on ThinkPad W541 and Dell Latitude E7240 - as reported by users. Notification of said fix provided courtesy of Nicholas Chin, who responded to the initial bug report.
• Merged a CVE fix implementing a bound check on ICMP packets in EDK2, with the EDK2 PXE code - not actually used as we use iPXE, so the bug never affected anyone and thus there was no RCE in the previous release. However, this fix was still merged. Merging the fix is the right thing to do, because who knows what someone might do with the source code that Libreboot distributes? Thus, the fix was merged. See: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m - patch is listed there, and that is what Libreboot has merged, to fix the issue described here. Again: the code, that this patch fixed, was never actually used in Libreboot setups, so nobody was ever actually affected by the bug described here. It is not the policy of Libreboot to allow major security bugs to remain unpatched, even on unused code, and thus this patch was merged as a matter of public service.
• Restored all Chromebooks to upstream config as per MrChromebox; 26.10 had initially used native raminit, libgfxinit and a few other things on Chromebooks up to Kabylake series, but some users reported bricks. Restoring to upstream config fixes issues, pending further testing upstream. From now on, Libreboot will only match upstream configuration, and work extensively with upstream.
• Courtesy of Nicholas Chin: updated the Dell Latitude patching, to fix fan control and battery status reporting, plus several other fixes, in a new ACPI handler (no more SMM bloat). Lid switch fixed on several latitudes, for S3 sleep. This replaces a much older, SMM-based patchset.
• Say the name of the tarball being created when running ./mk inject - this also makes it easy to know which tarball was created in bin/ for a build, as tarballs are ALSO now versioned, according to the lbmk revision. This was a bug because otherwise users didn’t know what the hell they built. Ditto: added a friendly remark at the end, when GbE region available, reminding the user to re-run it if they want to change the MAC address.
• mk: In a few places, added error output to stderr where it previously outputted wrongly to stdout.
• Dell OptiPlex 5050 SFF: disabled ASPM L0 to prevent AER error in Linux on Ron Nazarov’s wireless card.

• Tidied up the handling of serprog builds, modularising and generalising the code.
• build_sbase is once again a function instead of a macro, to prevent globbing issues in the code.
• Reduced usage of newvar - it is used now only in cases where we have unknown variables to initialise (variables initialised as per configuration). This reduces the attack surface, in case of future bugs.
• Don’t use backticks in lbmk. Use modern command subshell syntax.
• Removed unused srclink variable, initially used by EDK targets that relied on adding other payloads like GRUB, to symlink config from other trees to trigger re-build. This was replaced later by resolving project config hashes on the basis of dependencies as well - hashes of build dependencies and fetch dependencies added to the concatenation of hashes on the target build, thus dependency changes now trigger re-builds on targets.
• Removed forx function and a bunch of other hacky eval logic in the build system. Code was made simpler, and safer. Eval usage was reduced systematically, throughout.
• Split up SeaBIOS/GRUB payload logic in rom.sh - GRUB later removed entirely.
• Removed grubtree variable and instead specified the GRUB tree via payload_grub - and grub was later removed entirely.
• Decoupled GRUB/EDK2 payload insertion in rom.sh, modularising their behaviour; GRUB support was later removed entirely, in lbmk.
• Vendor injection: renamed fetch function to vfetch to eliminate maintainer confusion, as this is not a generalised fetch function. This is to avoid possible namespace pollution when later refactoring get.sh as it is likely someone (probably me) would write another function called fetch.
• Simplified and generalised code handling tarball creation
• Simplified some code in inject.sh

GRUB has been removed entirely. However, some development was done on the GRUB payload prior to deletion. Reasons for deletion can be found in the legacy page showing how to re-add GRUB, SeaBIOS etc - modern Libreboot, as in this release, is EDK2-only in release ROMs for most boards, to reduce the maintenance burden. Maintenance of legacy payloads shifted to the user. EDK2 information can be found on the EDK2 page.

However, the GRUB changes prior to GRUB being deleted were:

• Added GRUB utils to build.list, so that the user can run e.g. grub-mkpasswd-argon2 post-build.
• Enforce use of SeaGRUB when GRUB-coreboot is used - never allow lone GRUB.
• Blacklist USB modules in the EFI version of GRUB, as they are not needed.

SPDX-License-Identifier: GFDL-1.3-or-later

Markdown file for this page: https://libreboot.org/news/libreboot2611.md

Site map

This HTML page was generated by the Libreboot Static Site Generator.