CentOS Stream 10 – Common Problem 195 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

kpatch fails to apply with ‘patch already in transition’ or signature errors.

Environment & Reproduction

Customer kernel signed with an unenrolled MOK key.

uname -r
mokutil --sb-state

Root Cause Analysis

Secure Boot rejects unsigned livepatch modules.

Quick Triage

List installed and pending kpatches.

kpatch list
journalctl -k | grep -i kpatch | tail

Step-by-Step Diagnosis

Confirm Secure Boot and MOK state.

mokutil --list-enrolled | head -20

Solution – Primary Fix

Sign the kpatch module with an enrolled key.

openssl genrsa -out kpatch.key 4096
openssl req -new -x509 -key kpatch.key -outform DER -out kpatch.der -days 365
mokutil --import kpatch.der

Solution – Alternative Approaches

Disable Secure Boot temporarily in non-prod to validate the workflow.

mokutil --disable-validation

Verification & Acceptance Criteria

kpatch list shows the patch in ‘enabled’ state.

kpatch list
uptime

Rollback Plan

Unload the offending patch.

kpatch unload --all && systemctl disable kpatch

Prevention & Hardening

Codify MOK enrollment in build pipelines.

Automate patch management and compliance across your fleet with our DevOps services.

ls -la /var/lib/shim-signed/mok/

Related Errors & Cross-Refs

kpatch transition stuck, mokutil errors.

Related tutorial: View the step-by-step tutorial for centos-stream-10.

View all centos-stream-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

kpatch docs, MOK enrollment howto.