Libreboot 26.11 “Rubber Duck” was released on November 12, 2026, and on nearly every board it supports, the firmware now boots only through the EDK2 UEFI payload, with GRUB, GRUB-coreboot and MemTest86+ gone from the release images. The build changes are real and downloadable; the legacy-boot replacement and the Windows claim rest on much thinner evidence.
What shipped in 26.11
ROMs and a signed 1.68 GB source tarball are on the project’s rsync mirror. According to the Libreboot 26.11 release notes, which list every change since 26.10, boards that use the EDK2 payload now use nothing else, and the separate BIOS and UEFI coreboot targets have been merged into single targets whose ROM images carry bios_ or uefi_ prefixes. A minority of 32-bit-only Intel and AMD boards still run SeaBIOS. Users are told to convert existing OS installs to UEFI, with a full EFI system partition, before flashing; our guide to verifying, enabling or turning off Secure Boot on Linux covers one question that move raises.
The payload removals are released, not proposed. Anyone who still wants GRUB or MemTest86+ can place grub.efi or mt86plus.efi in the efi/ directory of lbmk, the Libreboot build system, and compile their own image; release builds skip that step.
TPM 2.0 and the Windows claim
TPM 2.0 is now on by default for the Topton X2e N150, the Supermicro X11SSH-F and the ThinkPad X270, X280, T480, T480s and T580. It had been off on those boards because of bugs in SeaBIOS’s TPM driver. Libreboot gives compatibility as the reason, with BitLocker on Windows as its example, and the same notes warn that discrete TPM chips on these boards can be sniffed. The release also says full UEFI makes Windows compatible. That is claimed: the one boot test the notes describe in any detail involves ReBIOS, not a current Windows install.
Chromebooks back on upstream configs
Libreboot 26.10, released October 15, imported more than 200 Chromebook configurations from MrChromebox as source-only targets, then swapped in native RAM init on Haswell models and libgfxinit on Intel models up to Kaby Lake. Some users reported bricked machines. 26.11 restores every Chromebook to MrChromebox’s upstream configuration, and the project says it will only match upstream from now on. The notes don’t say how many devices failed or which models. Chromebook images still aren’t released, and the bundled MrChromebox source doesn’t build as shipped because some blob repositories are left out. Owners who just want Linux on these machines without touching firmware have the route tracked in our Linux on Chromebook Crostini usage statistics.
One EDK2 security fix
Libreboot merged a bounds-check fix into its EDK2 tree for GHSA-99cj-7hg9-mp4m, TianoCore’s advisory on a pre-boot RCE in the EDK II PXE driver, published October 22 with a CVSS 4.0 score of 9.5 and no patched upstream release listed at the time. The project says its images never used that PXE code, since network boot goes through iPXE, so no remote code execution was possible. That is a plausible claim, and the patch is in place either way.
A legacy boot replacement that isn’t in the images
The release presents ReBIOS, a heavily modified SeaBIOS fork with its own VGA BIOS emulation, as the successor to CSMWrap, which 26.10 shipped and then deleted in a later revision for being buggy. ReBIOS is not built by lbmk and is not in any 26.11 image. The Libreboot legacy payload guide, which states that maintenance has shifted onto the user, says to fetch it from its upstream project and drop rebios.efi into efi/ yourself. It runs inside a hypervisor with hardware passthrough, so it needs Intel VT-d or the AMD IOMMU equivalent, and machines without one can’t use it. The only tested result on record is ReactOS and Windows XP booting on a ThinkPad X220. One board and two operating systems is a demonstration. For anyone with a BIOS-mode install, converting to UEFI before flashing is the only path the release actually ships.
What comes next
No release targets or deadlines are stated. Planned work includes blob repository support through ./mk inject, so images can be distributed without extra files, and a return of ./mk crosinfo in a branch for a later Chromebook update. ./mk import_uboot is due back once boards are tested, tied to a stated goal of becoming a U-Boot distribution. MemTest86+ and the other dropped payloads are expected to stay user-built. RBoot 26.11, the fork formerly called Canoeboot, made the same UEFI-only change.
