Microsoft has acknowledged two separate issues with recent Microsoft Defender for Endpoint (MDE) updates for Linux, including a bug that could leave endpoint protection disabled after a system reboot and another that prevented updates from installing on certain Red Hat Enterprise Linux (RHEL) systems.

The problems affected organizations using Defender for Endpoint to secure Linux servers in both on-premises and cloud environments.

Defender Could Become Disabled After Reboot

The most significant issue impacted Microsoft Defender for Endpoint for Linux versions 101.26042.0000 through 101.26042.0009.

According to Microsoft, systems running these versions could experience a situation where the Defender service failed to start after an upgrade or reinstallation followed by a reboot. If this occurred, the affected device could temporarily lose active endpoint protection until administrators applied Microsoft’s recommended fix.

Organizations using Microsoft Defender for Servers with Microsoft Defender for Cloud may have received the affected update automatically if automatic extension updates were enabled.

Installation Failures on FIPS-Enabled RHEL

Microsoft also identified a second issue affecting Red Hat Enterprise Linux 8 and 9 systems configured to operate in FIPS (Federal Information Processing Standards) mode.

On these systems, the same Defender update could fail during installation, leaving devices on an older version of the security software.

FIPS mode is commonly used in government agencies and highly regulated industries where approved cryptographic standards are required.

Microsoft Releases Updated Versions

To address the problems, Microsoft has published newer Defender builds:

• Version 101.26042.0011 resolves the issue that could disable the Defender service after reboot.
• Version 101.26052.0011 and later also fix the installation failure affecting FIPS-enabled Red Hat Enterprise Linux systems.

Administrators are encouraged to verify which Defender version is installed across their Linux infrastructure and update affected systems as soon as possible.

Why It Matters

Microsoft Defender for Endpoint is widely deployed in enterprise environments to provide endpoint detection and response (EDR), threat protection, and centralized security monitoring across Windows, Linux, and other supported platforms.

For organizations that rely on Microsoft’s security ecosystem, Linux servers are managed alongside Windows devices through the Microsoft Defender portal, providing a unified view of security events across the environment.

A malfunctioning endpoint protection service can significantly reduce visibility into attacks and leave workloads exposed until the issue is resolved.

Lessons for Administrators

Although Microsoft has released fixes, the incident serves as a reminder that security software updates should be validated before broad deployment whenever possible.

IT and security teams should consider:

• Verifying Defender service status after updates and system reboots.
• Monitoring update deployments across Linux servers.
• Testing security updates in staging environments before production rollout.
• Ensuring critical security services remain active after maintenance windows.

Final Thoughts

Security updates are designed to improve protection, but this incident highlights the importance of post-update verification—especially for endpoint security products.

Organizations running Microsoft Defender for Endpoint on Linux should confirm that their systems have been updated to the latest fixed versions and that the Defender service is operating normally after reboot to ensure continuous protection against modern cyber threats.