Ah, it's caused by the SBAT patch that newly added into gnu-efi. Since shim uses its own linker script, it needs an update. Shim upstream is planning to release shim 15.3 soon, and it should fix the issue.