diff --git a/backport-shim-don-t-set-second_stage-to-the-empty-string.patch b/backport-shim-don-t-set-second_stage-to-the-empty-string.patch
new file mode 100644
index 0000000000000000000000000000000000000000..4bc6805c1f139903172e86949df76a5be9127ca9
--- /dev/null
+++ b/backport-shim-don-t-set-second_stage-to-the-empty-string.patch
@@ -0,0 +1,54 @@
+From 0287c6b14c77eeb3e3c61996330850d43d937a2b Mon Sep 17 00:00:00 2001
+From: Jonathan Davies <jonathan.davies@nutanix.com>
+Date: Thu, 22 Feb 2024 16:24:01 +0000
+Subject: [PATCH] shim: don't set second_stage to the empty string
+
+When LoadOptions is either L" " or L"shim.efi ", parse_load_options sets
+second_stage to the empty string. This is unlikely to be what is intended, and
+typically leads to a non-obvious failure mode.
+
+The failure happens because parse_load_options's call to split_load_options
+(after eating shim's own filename, if present) returns the empty string. Since
+init_grub typically passes second_stage to start_image, this causes read_image
+to concatenate the empty string onto the directory name. This means PathName
+refers to the directory, not the path to a pe image. Then load_image
+successfully opens a handle on the directory and reads "data" from it. It only
+eventually fails when handle_image calls read_header which finds that this data
+isn't in fact a pe header, reporting "Invalid image".
+
+This scenario has been seen when shim is loaded via rEFInd 0.11.5, which sets
+LoadOptions to the name of the shim program followed by a space character.
+
+Instead, modify parse_load_options to leave second_stage set to its default
+value rather than the empty string.
+
+Reference:https://github.com/rhboot/shim/commit/0287c6b14c77eeb3e3c61996330850d43d937a2b
+Conflict:NA
+
+Signed-off-by: Jonathan Davies <jonathan.davies@nutanix.com>
+---
+ load-options.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/load-options.c b/load-options.c
+index a8c6e1a..8b92e37 100644
+--- a/load-options.c
++++ b/load-options.c
+@@ -447,10 +447,12 @@ parse_load_options(EFI_LOADED_IMAGE *li)
+ 
+ 	/*
+ 	 * Set up the name of the alternative loader and the LoadOptions for
+-	 * the loader
++	 * the loader if it's not the empty string.
+ 	 */
+ 	if (loader_str) {
+-		second_stage = loader_str;
++		if (*loader_str) {
++			second_stage = loader_str;
++		}
+ 		load_options = remaining;
+ 		load_options_size = remaining_size;
+ 	}
+-- 
+2.33.0
+
diff --git a/shim.spec b/shim.spec
index ce0045d3e6fcf80222de22073f410d875e9fa965..bb4fe8b16e46d8d673fdf9cd740215187854c5ef 100644
--- a/shim.spec
+++ b/shim.spec
@@ -25,7 +25,7 @@
 
 Name:	   	   shim
 Version:	   15.6
-Release:	   20
+Release:	   21
 Summary:	   First-stage UEFI bootloader
 ExclusiveArch:     x86_64 aarch64
 License:	   BSD
@@ -85,6 +85,7 @@ Patch48:backport-CVE-2023-0465.patch
 Patch49:backport-CVE-2023-2650.patch
 Patch50:backport-CVE-2024-0727.patch
 Patch51:backport-Always-clear-SbatLevel-when-Secure-Boot-is-disabled.patch
+Patch52:backport-shim-don-t-set-second_stage-to-the-empty-string.patch
 
 # Feature for shim SMx support
 Patch9000:Feature-shim-openssl-add-ec-support.patch
@@ -214,6 +215,9 @@ make test
 /usr/src/debug/%{name}-%{version}-%{release}/*
 
 %changelog
+* Tue Oct 22 2024 fuanan <fuanan3@h-partners.com> -15.6-21
+- backport patch from upstream
+
 * Tue May 7 2024 yixiangzhike <yixiangzhike007@163.com> - 15.6-20
 - fix the TPCM feature issue