This bug has become visible after upgrading the grub2 packages from
2.14-2 to 2.14-3.

After reverting commit:
https://salsa.debian.org/grub-team/grub/-/commit/8719ef8a523f2a89aeff1b86f5e14c3bba7a7d11
or downgrading back to grub2 2.14-2 I'm able to boot again.

I can confirm the same issue: upgrading to grub 2.14-3 makes all the
systems I tried this on unbootable with similar messages.

Reverting to previous versions (in my case, to 2.12-9) immediately
fixes the problem.

Cheers,

I can also confirm the exact same issue after upgrading to grub2 2.14-
3.

This problem has already been addressed and fixed in the upstream
repository:
https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/089d0567cee02464268cfc1c29830ab12dd17e68

The fix is included in the recent upstream release: 2.16~rc1, so this
issue should be resolved after the debian package switches to the 2.16
codebase.

In the meantime, I have successfully resolved this issue locally by
cherry-picking the relevant upstream commits. The patched package works
well under the environment where "Secure Boot validation is disabled in
shim".

FYI, here is the steps I took to rebuild the package, overwrite the
grubx64.efi of 2.14-3, and verify:

$ mkdir grub2; cd grub2
$ sudo apt install build-essential git-buildpackage
$ sudo apt install build-dep grub2
$ gbp clone vcsgit:grub2
$ cd grub/debian/patches
$ for id in \
    089d0567cee02464268cfc1c29830ab12dd17e68 \
    9922ed133c2c754ec9f37198da2b3e3e8a4fd5ff \
    9f4a586f1227a8287e1d6acd95893f6098756ee2 \
    ce6f2b57f5450a8239022dcbfb2d750f273b83cb \
    675d8581037dc8996cf6db21a61d26e28f7d44c
  do
    patch="${id}.patch"
    curl -o "$patch" \
 "https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/${id}.patch"
    echo "$patch" >> series
  done

$ cd ../../
$ env DEBEMAIL="your email" DEBFULLNAME="Your name" \
  gbp dch -S -N 2.14-4
$ git add . && \
  git commit -am 'Cherry-pick upstream patches to fix bug #1141142'
$ gbp pq import
$ gbp pq export
$ git add . && git commit -am 'clean up the upstream patches'
$ mkdir ../build-area
$ env DEB_BUILD_OPTIONS=nocheck gbp buildpackage \
  --git-export-dir=../build-area \
  --git-builder='debuild --no-lintian -i -I -uc -us'
$ cd ../build-area
$ dpkg-deb -x grub-efi-amd64-unsigned_2.14-4*.deb .

# Overwrite the unsigned binary to the installed 2.14-3 binary,
$ sudo cp ./usr/lib/grub/x86_64-efi/monolithic/grubx64.efi \
 /boot/efi/EFI/BOOT/grubx64.efi
$ sudo cp ./usr/lib/grub/x86_64-efi/monolithic/grubx64.efi \
 /boot/efi/EFI/debian/grubx64.efi
$ sync; sudo reboot