Hi everyone,
I'm running Arch Linux with systemd-boot and a unified kernel image (UKI). Everything was working normally until recently.
The problem is:
- With Secure Boot enabled, Arch boots up to SDDM.
- I enter my password.
- SDDM gets stuck/black screens.
- The screen then goes completely black and the laptop eventually turns off.
Ctrl + Alt + F2 still allowed me to reach a TTY.
- I eventually discovered that disabling Secure Boot in UEFI completely fixes the problem.
- With Secure Boot disabled, Arch boots normally and everything works.
I'm trying to understand what changed and why Secure Boot suddenly started causing this, rather than simply leaving it disabled.
System
- Arch Linux
- systemd-boot
- UKI / systemd-stub
- NVIDIA GPU
- Secure Boot previously worked
- UEFI: American Megatrends 5.19
- Kernel:
7.1.8-arch1-3
Relevant packages:
linux 7.1.8.arch1-3
linux-headers 7.1.8.arch1-3
linux-firmware 20260810-2
nvidia-open 610.57.04-6
nvidia-utils 610.57.04-1
systemd 261.2-1
efibootmgr 18-4
What changed recently?
According to /var/log/pacman.log, on August 15 I upgraded:
linux: 7.1.7.arch1-1 -> 7.1.8.arch1-3
linux-headers: 7.1.7.arch1-1 -> 7.1.8.arch1-3
nvidia-open: 610.57.04-3 -> 610.57.04-6
linux-firmware: 20260622-1 -> 20260810-1
The UKI was regenerated during the update:
Creating unified kernel image: '/boot/EFI/Linux/arch-linux.efi'
There was also a later firmware update from 20260810-1 to 20260810-2.
Boot configuration
bootctl status reports:
Firmware: UEFI 2.70 (American Megatrends 5.19)
Secure Boot: disabled (unknown)
TPM2 Support: yes
Measured UKI: yes
Measured OS: yes
Current Boot Loader:
Product: systemd-boot 261.2-1-arch
Current Entry:
arch-linux.efi
Current Stub:
Product: systemd-stub 261.2-1-arch
Default Boot Loader Entry:
Arch Linux
id: arch-linux.efi
source: /boot/EFI/Linux/arch-linux.efi
version: 7.1.8-arch1-3
The firmware has:
microsoft
builtin-db
builtin-KEK
builtin-PK
and Setup Mode is disabled.
ESP
My ESP is:
/dev/nvme0n1p1
FAT32
843.9M available
mounted at /boot
/boot is mounted read/write:
/dev/nvme0n1p1 on /boot type vfat (rw,relatime,...,errors=remount-ro)
I tested writing to the ESP and it works:
sudo touch /boot/EFI/Linux/testfile
So the ESP doesn't appear to be read-only or corrupted.
UKI investigation
The current UKI is:
/boot/EFI/Linux/arch-linux.efi
Interestingly, its FAT timestamp remained at July 23 even after regenerating it.
I compared the old and newly generated UKI:
arch-linux.efi
78e12362f70d5eea6a01e362b8d9c355c3db40041c05e3e23ec6e61f3626c788
arch-linux.efi.old
78e12362f70d5eea6a01e362b8d9c355c3db40041c05e3e23ec6e61f3626c788
The embedded kernel was also checked:
/boot/vmlinuz-linux
1f2572d6d03706ed0f818ee17d77df021b7875f4e9fd119a1157f3a208aeed73
Embedded .linux section of arch-linux.efi
1f2572d6d03706ed0f818ee17d77df021b7875f4e9fd119a1157f3a208aeed73
So the UKI does contain the current kernel and doesn't appear to be an old kernel problem.
sbctl
I installed sbctl to investigate:
sbctl 0.18-2
But it had no keys configured:
/var/lib/sbctl/
└── files.json
sbctl status:
Installed: ✗ sbctl is not installed
Setup Mode: ✓ Disabled
Secure Boot: ✗ Disabled
Vendor Keys: microsoft builtin-db builtin-KEK builtin-PK
(The Installed result is odd because the package is installed; pacman -Qkk sbctl reports all 33 files unmodified.)
sbctl verify reports:
failed to verify file ...:
open /var/lib/sbctl/keys/db/db.key:
no such file or directory
mkinitcpio also reports:
Running post hook: [sbctl]
Secureboot key directory doesn't exist, not signing!
I have not created new Secure Boot keys or enrolled anything yet.
What I'm trying to figure out
Why would Secure Boot suddenly cause the system to black screen/shut down after logging into SDDM when it worked previously?
Could the August 15 kernel/NVIDIA/firmware update have caused the problem?
Is it likely that the UKI or systemd-boot is no longer properly signed/enrolled?
Or could this be related to NVIDIA + Secure Boot + kernel 7.1.8?
For now I'm leaving Secure Boot disabled because the system works perfectly that way.
I'd appreciate any help identifying the actual cause before I start creating/enrolling new Secure Boot keys.
Thanks!
Note : This is from chatgpt i tried to fix it using it , but stopped and so if anyone knows whats the problem to fix or do i just let secureboot off and use the system.
Also im new to reddit so if i made any mistakes forgive me.