Symptoms
- Driver installs but doesn't load after reboot
- 'Secure Boot violation' message at startup
- Hardware (graphics, Wi-Fi) reverts to a generic fallback driver
- MOK (Machine Owner Key) enrollment prompt appears at boot
Likely causes
- CommonThird-party driver isn't signed for Secure BootOpen-source and default drivers are usually signed, but some proprietary ones aren't automatically.
- CommonMOK enrollment wasn't completedThe installer generates a signing key that must be manually enrolled through a blue MOK screen at boot, and skipping it leaves the driver unsigned.
- PossibleSecure Boot policy blocking all unsigned modulesVery strict configurations may reject any driver not from the distribution's own signed set.
What to do
- When installing a driver that mentions DKMS or module signing, watch for a blue MOK management screen on the next reboot and follow it to enroll the key.
- If you missed it, reinstall the driver package and reboot again, watching carefully for that screen.
- Check with 'mokutil --sb-state' whether Secure Boot is currently enabled.
- As a straightforward workaround, disable Secure Boot in the BIOS/UEFI settings if you don't specifically need it for other security reasons.
- After disabling Secure Boot, reboot and confirm the driver now loads with 'lsmod | grep [driver name]'.
- If you want to keep Secure Boot enabled, follow your distribution's specific documentation for manually signing custom kernel modules.
Tools and parts
- Terminal access with sudo privileges
When to call a pro
If MOK enrollment repeatedly fails or Secure Boot policy is set by a workplace, an IT professional or Linux specialist can assist.
Safety
Generally low risk
Generally low risk for a careful person. Stop if anything looks different from what this guide describes.