The merged change uses USBGuard for USB devices and Bolt for Thunderbolt and USB4 accessories that attach as PCI Express devices. A new device stays blocked until the user chooses Allow once, Always allow this device, or Keep blocked. Remove, then Security, then USB Device Authorization turns that USB protection off. An approval saved for a device still applies if the device moves to another port.

USB at Boot, under Setup and then Security, is a separate choice. The pull request says that with it on, even a trusted USB keyboard is unavailable at an encrypted-disk prompt until USBGuard starts. It also says an older snapshot from before USBGuard keeps every USB device disabled after startup, including keyboards, networking, and storage.

Thunderbolt protection sits under Setup, then Security, then Thunderbolt, with the same three approval choices. acrogenesis opened the pull request, and ErikMelton merged it. The pull request says the reported tests were the author's, including lab virtual machines, and that a full factory reset was not performed.