Why is my Linux update tool offering Microsoft UEFI updates?

These are Secure Boot trust database updates, not Windows updates. The CA entry lets firmware recognize certain Microsoft-signed boot components, including the shim that some Linux distributions use to start Linux with Secure Boot enabled. The dbx is a revocation list for signatures that should no longer be trusted.

They can be offered on a Linux system because firmware updates are not tied to which operating system you use. If you keep Secure Boot off, they may not affect your current boot setup, but the dbx update can still change what the firmware will accept if Secure Boot is enabled later.

This is usually delivered as a firmware update through the system’s update service. Your computer’s firmware has Secure Boot keys and databases of its own, so Linux can help update them without needing Windows installed.

If you do not use Secure Boot, there may be no immediate benefit for your current setup. I would still read the update details and follow the normal firmware update precautions rather than assuming every firmware change is risk-free.

Short version: it is for Secure Boot compatibility and security, not a requirement for Linux in general. Some Linux installations rely on a Microsoft-signed first-stage bootloader so they can start on machines that trust Microsoft’s Secure Boot signing chain.

With Secure Boot disabled, you can likely leave the update alone if you have no reason to change that setup. If you might turn Secure Boot back on, check your distribution’s guidance, since the exact boot arrangement can vary.