Okay, I should have realized this when I added a comment. I'd not seen it impact NVIDIA drivers before, but I have seen it impact other drivers (VMware Workstation).
For me at least, the issue is caused by secure boot. SecureBoot ensures that the drivers are from a trusted source. Usually, the vendor of said drivers would sign the driver to ensure folks know it is from theatvendor, and that the trust key is in the local store. Browsers use the same thing for HTTPS connections. However, my bios doesn't seem to have the key for the signed binaries for the NVIDIA drivers.
So 2 options:
- Disable secure boot. It's different in every BIOS, but the basic steps are:
- Boot device
- Hit the appropriate key to enter the BIOS settings. This is usually F2, Del, F12, or similar.
- There may be a security section in the BIOS
- Find the Secure Boot options and turn it off
- Save & Exit the BIOS settings
- Sign the binaries
- Generate a private key and certificate
sudo openssl req new -x509 -newkey rsa:2048 -keyout /etc/ssl/private/MOK.priv -outform DER -out /etc/ssl/certs/MOK.der -nodes -days 36500 -subj "/CN=SecureBIOS/"
- Import the certificate into the BIOS using mokutil
sudo mokutil --import /etc/ssl/certs/MOK.der
sudo /usr/src/linux-headers-`uname -r`/scripts/sign-file sha256 /etc/ssl/private/MOK.priv /etc/ssl/certs/MOK.der $(modinfo -n nvidia-drm)
sudo /usr/src/linux-headers-`uname -r`/scripts/sign-file sha256 /etc/ssl/private/MOK.priv /etc/ssl/certs/MOK.der $(modinfo -n nvidia)
sudo /usr/src/linux-headers-`uname -r`/scripts/sign-file sha256 /etc/ssl/private/MOK.priv /etc/ssl/certs/MOK.der $(modinfo -n nvidia-modeset)
sudo /usr/src/linux-headers-`uname -r`/scripts/sign-file sha256 /etc/ssl/private/MOK.priv /etc/ssl/certs/MOK.der $(modinfo -n nvidia-peermem)
sudo /usr/src/linux-headers-`uname -r`/scripts/sign-file sha256 /etc/ssl/private/MOK.priv /etc/ssl/certs/MOK.der $(modinfo -n nvidia-uvm)
What is interesting is that it does look like mine are already signed by a key on my laptop because doing modinfo nvidia
shows a signature, and it's subject is that of my laptop. So there is something in the kernel upgrade process that signs the drivers automatically, however something seems to have gone missing and not installed the key in key storage so it is no longer trusted. I'm sure somebody much more familiar with kernel installations would know the post-install scripts that should handle that, and where the key is stored.
Edit: This might be related: https://bugs.launchpad.net/ubuntu/+source/linux-restricted-modules/+bug/2027914