shim (mok.c mirror_one_esl): NULL pointer dereference while printing an error message stops the node from booting

Impact

NULL pointer dereference while printing an error message stops the node from booting. On a fleet this is a denial of service you cannot fix over SSH - it needs console or BMC access per affected node, which is expensive at scale.

Who can reach it

Requires attacker-influenced MOK/ESL data on the node.

What to do

shim package update + reboot. Availability-only, so it can ride a normal maintenance window rather than an emergency one.

References