Ubuntu not booting and initial ramdisk not loading

[Shrimpoodle]

I am not an advanced user. Ubuntu is the only operating system I use. 6 days ago Ubuntu said I needed to update my UEFI to the 2023 version, so i did. After i restarted, it said it still needed to update, so i clicked on it again. But this time the update took a lot longer and seemed stuck so i just canceled it for now.

I shut down my laptop and went to turn it on the next day, but it seemed like it froze after i tried to boot ubuntu. (I tried multiple times). So i entered the advanced options menu and clicked on recovery mode, but it got stuck on loading initial ramdisk. I used a live usb and clicked "try or install ubuntu" but it gave me a blank screen for several hours. Then i decided to go back to the gnu grub menu and check the memory, but it said "bad shim signature". then i realized i could just temporarily disable secure boot and use ubuntu to reinstall grub. So i went back to firmware settings (mine is insyde H2O BIOS) and disabled "enforce secure boot" since the regular secure boot setting was locked, but it seems like this did disable secure boot. It still didnt work. I did the memory test again but this time i got a blank screen. Using ls in the grub command line, i can only see .efi files. In the firmware settings there is nothing related to CPU.

All of the solutions i saw online either didnt match up to what grub showed me or they were too complex for me. If anyone could give me some advice about this i would really appreciate it.

 

[Alexzee]

You said you can only see the .efi files.
Can you see the /root partition?

Got Timeshift installed?
And, what kernel are you running now?

"Bad shim signature" means that the UEFI Secure Boot blocks the signature from loading because it can't verify the bootloader or the kernel.


With the Live usb up and running please post the output of this command.

sudo fdisk -l

(small letter L)

See here:

UEFI Secure Boot:- bad shim signature

Before proceeding I don't want to disable the Secure Boot option. I need a solution, not a workaround. I have a humble setup using dnsmasq and the dnsmasq built-in tftp to give me a PXE server. I am

askubuntu.com

Our members @bob466 and @Condobloke may be able to help.

 

[Condobloke]

G'day Shrimpoodle, Welcome to Linux.org

Which version of Ubuntu is this ?



Did you see an error?..... anything like;
Failed to write-firmware: failed to write (null): failed to write data to efivarsfs: Error writing to file descriptor: Invalid argument

?

Can you still boot to the live usb ?
Is there anything you need to save?....(music/data/files etc etc ?)

If there is I would save it to an external drive....Now.

I think you may need to reinstall.

Give us some detail about your pc, Laptop?....RAM, make and model?...as much as you can, Please.

If you choose to reinstall, I would install Linux Mint

But first, give us as much detail as you can.

 

[bob466]

Welcome to the Forum.

I'd download Linux Mint.
Depending on your computer specs...I'd try Mint xfce 22.3...I have 22.1 running on my old Laptop. Secure Boot must be disabled to run any Linux Distro otherwise it will cause a lot of grief.

Trying to work out what's happened and how to fix it would take forever...it's much quicker to do the above.

 

[osprey]

Secure Boot must be disabled to run any Linux Distro otherwise it will cause a lot of grief.

The major linux distros ubuntu, debian, fedora, mint, support UEFI secure boot seamlessly out-of-the-box. Each distro uses a signed pre-bootloader named "shim" that provides trust to the operating system. Secure boot "just works" without blocking normal computer use. If by chance it doesn't work, then there are likely some specific issues generic to the particular system that would need to be investigated to find the cause of such an issue since in general, the shims supplied by distros work.

For ubuntu, there's info here: https://documentation.ubuntu.com/security/security-features/platform-protections/secure-boot/

For info on how to use secure boot for custom kernels or modules, see @f33dm3bits thread here:

Thread 'HowTo: Linux and Secure boot'

Jan 14, 2025

I know not everyone is a fan of secure-boot but I recently discovered an easy way to easily setup secure-boot
using a tool called "sbctl", which allowed me to use the Microsoft keys already in your UEFI to sign a custom kernel, but you can also enroll your own custom keys if you prefer to do that. I used the easy option which is using the Microsoft keys because I don't like headaches and over-complicating things when it can be done the easy way.

DISCLAIMER: I AM NOT RESPONSIBLE FOR BRICKING YOUR SYSTEM! DO AT YOUR OWN RISK!

This worked for me on my first try so this is actually...

• f33dm3bits
• Replies: 2
• Forum: Desktop

• 
• 

In relation to the original problem, @Shrimpoodle wrote:

After i restarted, it said it still needed to update, so i clicked on it again. But this time the update took a lot longer and seemed stuck so i just canceled it for now.

The problem with stopping an upgrade before it completes is that it leaves the system in a corrupted state because some applications may have been fully downloaded but only partially installed which makes them unusable. The metadata for such applications is likely to be incomplete or absent so the operating system doesn't know what it needs to know to run them. That includes the initial ramdisk.

Given the errors mentioned in post #1, the simplest solution for someone not well-versed in linux is to re-install the whole operating system from scratch.

 

[Condobloke]

The problem with stopping an upgrade before it completes is that it leaves the system in a corrupted state because some applications may have been fully downloaded but only partially installed which makes them unusable. The metadata for such applications is likely to be incomplete or absent so the operating system doesn't know what it needs to know to run them. That includes the initial ramdisk.

Given the errors mentioned in post #1, the simplest solution for someone not well-versed in linux is to re-install the whole operating system from scratch.

Totally agree with the above.

@Shrimpoodle ...take note of this ^^^

 

[f33dm3bits]

It might have to do with this.

disabled "enforce secure boot" since the regular secure boot setting was locked, but it seems like this did disable secure boot. It still didnt work. I

Given the errors mentioned in post #1, the simplest solution for someone not well-versed in linux is to re-install the whole operating system from scratch.

All of the solutions i saw online either didnt match up to what grub showed me or they were too complex for me. If anyone could give me some advice about this i would really appreciate it.

There's also this.

Microsoft Secure Boot certificates expire June 27—here's what that means for your old PC

Most PCs should continue working fine, even if they don't receive the updated certificates.

www.howtogeek.com

That would probably mean you would have to update your BIOS/UEFI by getting the latest version from your montherboard's website and updating via the BIOS/UEFI flashtool from within the BIOS/UEFI. Some hardware is supported by fwupd, but a lot isn't. So if it's still a secure-boot problem doing the first probably be good so that you know you have the latest firmware with the most update-to-date certificates. So what @osprey said is probably easiest for you as other solutions were already too complicated for you as you mentioned yourself already.

 

[bob466]

Everyone has an opinion on secure boot...Linux Mint supports it but do you want this type of trouble...
https://linuxmint-installation-guide.readthedocs.io/en/latest/efi.html

My Towers Motherboard is UEFI but has secure boot disabled and I can install any Distro I like with zero trouble as it should be.

 

[Shrimpoodle]

I bought this laptop in May 2024 from Juno Computers. It came preinstalled with Ubuntu 24.04.4 which i still use up until now. Its model is NJ70PU. Its architecture is x86. Its DE is GNOME.

I have no idea how I didn't see this before or maybe I just needed to restart grub again, but apparently I am able to see all my files in grub, including /root, but the only thing inside /root is a few snap files.

I run the Linux kernel and don't have Timeshift.

This paragraph is about what happened with a live USB trying to run Ububtu, Mint, and Finnix, and they all had the exact same result as follows. I disabled secure boot. Booting from the command line gave me the error: you need to load the kernel first (this also happened in the regular partition). Prefix, root, vmlinuz, and initrd were all correct. So i used the linux and initrd conmands and booted from the command line but it stayed stuck there for an hour until I turned off my laptop.

Compatibility mode in Mint in the live usb got me as far as "Measured initrd data into PCR 9" before getting stuck.

I haven't backed up my files in a while. In my situation is it possible to mount an external drive and transfer files onto it?

 

[KGIII]

I am able to see all my files in grub, including /root, but the only thing inside /root is a few snap files.

If you can see /home/<user>, it's a good idea to back up those files (at least those you care about) before following this:

Given the errors mentioned in post #1, the simplest solution for someone not well-versed in linux is to re-install the whole operating system from scratch.

You'll need external media to create an Ubuntu installer. USB thumb drives are the most common, as our reliance on optical media slowly fades away into the dustbin of history.

I'd personally re-enable secure boot before doing a clean install. You may still need to edit the BIOS to remove the old entry and add a new instance. At this point, a clean installation is your best/easiest option.

 

[Alexzee]

I bought this laptop in May 2024 from Juno Computers. It came preinstalled with Ubuntu 24.04.4 which i still use up until now. Its model is NJ70PU. Its architecture is x86. Its DE is GNOME.

I have no idea how I didn't see this before or maybe I just needed to restart grub again, but apparently I am able to see all my files in grub, including /root, but the only thing inside /root is a few snap files.

I run the Linux kernel and don't have Timeshift.

This paragraph is about what happened with a live USB trying to run Ububtu, Mint, and Finnix, and they all had the exact same result as follows. I disabled secure boot. Booting from the command line gave me the error: you need to load the kernel first (this also happened in the regular partition). Prefix, root, vmlinuz, and initrd were all correct. So i used the linux and initrd conmands and booted from the command line but it stayed stuck there for an hour until I turned off my laptop.

Compatibility mode in Mint in the live usb got me as far as "Measured initrd data into PCR 9" before getting stuck.

I haven't backed up my files in a while. In my situation is it possible to mount an external drive and transfer files onto it?

Thanks for confirming that the root, vmlinuz and initrd were all correct.
Yes, you should be able to run a Live version of any Linux distro and transfer the files to an external drive.

For your next fresh installation I highly recommend that you install Timeshift. Timeshift can fill your drive up quickly. You may want to consider an external drive to have Timeshift place your snapshots to.
That way if you have problems again you can set your operating system back to a snapshot where there weren't any issues.

I suspect what caused the "you need to boot the kernel first" was either a secure boot conflict or a failed update (machine in a state of unresponsiveness) to the kernel.

 

[Shrimpoodle]

For now I want back up my files and install Mint. But how do I install anything when the kernel is broken and not letting me boot from a live usb? I have no way of booting into any OS so is it possible to install an OS using grub, or reinstall the kernel using grub? And how would i do that?

 

[Trml]

I have no way of booting into any OS so is it possible to install an OS using grub, or reinstall the kernel using grub? And how would i do that?

An Ubuntu recovery method from Grub is described in this article: https://www.dropvps.com/blog/boot-ubuntu-24-04-into-rescue-mode

Indeed be careful not to install anything before you have backed up your files. edit: Also don't execute / reinstall according to the instructions there. Use the guide to see if you get into rescue mode and see your files.

You should be able to attach a USB drive - ideally back up your full /home/ directory path first, if the above recovery boots. If you need instructions how to do that, best confirm first it boots from recovery and you got the USB attached.

I'm wondering if your issue has something to do with the expiry of MS certificate, @f33dm3bits linked in post #7. Note the date is today and if you had not updated the machine for some months, that update may be outstanding. For that reason, if it won't boot, what I would do is set the date back in Bios/UEFI and try again to boot without network cable attached.

 

[KGIII]

not letting me boot from a live usb? I

You'd want to fix that first, I'd think. Do you have another computer that you can use to write the .iso file to the USB?

Check in BIOS, where you can usually set the boot order. When it's time, tell it to boot to USB/external media first.

Alternatively, your computer almost certainly has a one-time setting that will let you pick the external drive as your boot option. Most folks, as far as I know, just use that method.

You might access the BIOS with ESC or F12, while the temporary boot order may be accessed with the F2 button. (Those are examples. They're not necessarily what your system has set up.)

Just like you have to rapidly select the button to access the BIOS, you need to do the same thing with the one-time boot order change. Start spamming that button, pressing it over and over, as soon as the computer's power turns on.

 

[Condobloke]

But how do I install anything when the kernel is broken and not letting me boot from a live usb?

The fact that a usb stick cannot be booted to has nothing to do with the broken kernel etc etc
It will have to do with the usb stick itself
The downloaded .iso file
The usb not being set up as a bootable usb
User error

I haven't backed up my files in a while. In my situation is it possible to mount an external drive and transfer files onto it?

Only when you can access the files. If the current OS cannot be booted to then you cannot access the files.
However, if you succeed in making a usb stick bootable, and then succeed in booting using that same usb stick.....Then you should be able to access your files and either copy and paste them to an external drive, or drag n drop them to the external.

Tell me how you are making the usb stick bootable.
For example, are you using windows pc to set the usb stick up ?

Write in some detail about how you are going about that, please.

 

[Condobloke]

If you do have a windows pc, follow the below instructions, using Balena Etcher

There's a version of balenaEtcher that can be used without installing it onto your computer.
Just download balenaEtcher-portable.exe and open/execute it.
If there's a security warning, confirm that you want to open balenaEtcher.
Then select an ISO file, select the target device (your USB stick), finaly flash. That's it.

There is need to format the usb stick. Etcher will take care of that during the flash process

Do not interrupt it.

 

[Shrimpoodle]

Tell me how you are making the usb stick bootable.
For example, are you using windows pc to set the usb stick up ?

Write in some detail about how you are going about that, please.

I have an old windows computer that i used to get the .iso files and I used Rufus to put them on the USB. My actual partition scheme is GPT, but I tried making the usb with both MBR and GPT, and both gave me the following problem. I tried with ISO amd DD mode and both gave me the following problem. When I power on my broken laptop it always automatically goes into the grub menu for ubuntu. From there I go into BIOS, plug in the usb, and boot from the usb. That takes me to the grub menu of the distro that's on the usb. So I can see the options like boot, memory test, and BIOS, but BIOS is the only option that works. I can also edit the menu entries and see the command line from that screen. So the live usb works, its just that the boot entry doesn't work, so I don't have access to the main part of the OS, just its menu. In every distro I tried, trying to boot from the command line with the live usb running gives "error: you need to load the kernel first." It's the same situation for my usual partition as well.

An Ubuntu recovery method from Grub is described in this article: https://www.dropvps.com/blog/boot-ubuntu-24-04-into-rescue-mode

Indeed be careful not to install anything before you have backed up your files. edit: Also don't execute / reinstall according to the instructions there. Use the guide to see if you get into rescue mode and see your files.

You should be able to attach a USB drive - ideally back up your full /home/ directory path first, if the above recovery boots. If you need instructions how to do that, best confirm first it boots from recovery and you got the USB attached.

I'm wondering if your issue has something to do with the expiry of MS certificate, @f33dm3bits linked in post #7. Note the date is today and if you had not updated the machine for some months, that update may be outstanding. For that reason, if it won't boot, what I would do is set the date back in Bios/UEFI and try again to boot without network cable attached.

Unfortunately the article didn't work, just led me to a blank screen so i think it's still a kernel issue. When I changed the date and unplugged the internet, booting didn't work, as I expected, and when I selected memory test, it still said "error: bad shim signature." That's with secure boot enabled. With secure boot disabled, both booting and memory test are just a blank screen.

 

[Trml]

After what you describe, I see two options:
1) Your UEFI bios could have a menu item to reset the secure boot database to factory defaults. This should allow to boot again after a reset and deactivating secure boot. After deactivating secure boot one can still update the database, after which turning it on could be done.
2) A UEFI firmware update by the machine vendor. Theoretically they should have provided one for the same reason Ubuntu tried to update it, but theirs should work.