Ubuntu 26.04 LTS – Secure Boot blocks unsigned DKMS kernel module load – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Hardware driver features fail because DKMS modules do not load on Secure Boot systems.

Environment & Reproduction

Common after kernel upgrades rebuilding unsigned third-party modules.

modprobe 
dmesg | tail -n 80

Root Cause Analysis

Module signature verification fails because MOK enrollment or signing is missing.

Quick Triage

Confirm Secure Boot state and module signing metadata.

mokutil --sb-state
modinfo  | grep -E 'signer|sig_key|sig_hashalgo'
dkms status

Step-by-Step Diagnosis

Identify exact kernel log rejection message and current MOK keys.

journalctl -k -n 120 --no-pager | grep -i -E 'module verification|secure boot|Lockdown'
mokutil --list-enrolled

Solution – Primary Fix

Generate/enroll MOK and sign DKMS module for current kernel.

sudo mokutil --import /var/lib/shim-signed/mok/MOK.der
sudo /usr/lib/linux-kbuild-$(uname -r | cut -d. -f1-2)/scripts/sign-file sha256 /var/lib/shim-signed/mok/MOK.priv /var/lib/shim-signed/mok/MOK.der $(modinfo -n )
sudo modprobe 

Solution – Alternative Approaches

Use vendor-signed modules from Ubuntu repositories when available.

apt search 
sudo apt install -y 

Verification & Acceptance Criteria

Module loads with no signature errors and dependent hardware functions correctly.

lsmod | grep 
journalctl -k -n 40 --no-pager

Rollback Plan

Remove problematic DKMS package and boot with previous working kernel if needed.

sudo apt remove --purge -y 
sudo grub-reboot '1>2'

Prevention & Hardening

Automate DKMS signing during post-build hooks and track MOK enrollment status.

Automate patch management and compliance across your fleet with our DevOps services.

dkms status
mokutil --list-enrolled

Related Errors & Cross-Refs

Related to module ABI mismatch after kernel updates and initramfs omissions.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu Secure Boot, MOK enrollment, and DKMS signing guides.