How to Fix VMware Module Errors When Secure Boot Is Enabled on Linux

{"time":1777326565801,"blocks":[{"id":"IOORnywrcW","type":"paragraph","data":{"text":"If you've ever tried to start VMware on a Linux machine and hit an error about vmmon or vmnet modules failing to load, there's a good chance Secure Boot is the culprit. This guide walks you through exactly what's happening and gives you two ways to fix it — the quick-and-easy way and the cleaner long-term approach."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"QreEH_b-R0","type":"delimiter","data":{},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"aKOSVLUgpC","type":"header","data":{"text":"What's Going On?","level":2},"tunes":{"alignTune":"left"}},{"id":"qsprkh0QCP","type":"paragraph","data":{"text":"Secure Boot is a UEFI firmware feature that prevents unsigned code from loading during boot. It's a legitimate security protection — but it also means that kernel modules like VMware's vmmon and vmnet won't load unless they're signed with a trusted key."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"kqiQP6JcE0","type":"paragraph","data":{"text":"When VMware installs or rebuilds those modules, it doesn't automatically sign them. So if Secure Boot is enabled, Linux refuses to load them, and VMware fails to start."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"Tc8BY_JXUF","type":"paragraph","data":{"text":"You can confirm this is your issue by running:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"Qdb7oOEnNW","type":"code","data":{"code":"mokutil --sb-state"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"p6uYo25tVH","type":"paragraph","data":{"text":"If it returns SecureBoot enabled, you've found your problem."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"6deqbnwRoe","type":"delimiter","data":{},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"9GW1Uodkud","type":"header","data":{"text":"Option 1 — The Quick Fix: Disable Secure Boot","level":2},"tunes":{"alignTune":"left"}},{"id":"b7wC4NmDe8","type":"paragraph","data":{"text":"If you don't have a specific reason to keep Secure Boot enabled, this is the fastest path back to a working VMware setup."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"UqOiooOllK","type":"list","data":{"style":"ordered","items":["Reboot your machine and enter your BIOS/UEFI settings (usually F2, F10, Del, or Esc on startup)","Find the Secure Boot option and disable it","Save and boot into Linux","Rebuild and load the VMware modules:"]},"tunes":{"alignTune":"left"}},{"id":"1tY-amVGK8","type":"code","data":{"code":"sudo vmware-modconfig --console --install-all\nsudo modprobe vmmon\nsudo modprobe vmnet"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"JIDPeWxkjq","type":"list","data":{"style":"ordered","items":["Start VMware normally"]},"tunes":{"alignTune":"left"}},{"id":"A6XHKKKZvg","type":"paragraph","data":{"text":"Pros: Fast, simple, no ongoing maintenance.
Cons: You lose the security protections that Secure Boot provides."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"EP9Xn_Hor9","type":"paragraph","data":{"text":"If that trade-off is fine for your environment, you're done. If not, read on."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"zwV-ZHtKjd","type":"delimiter","data":{},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"czbjhHTeO8","type":"header","data":{"text":"Option 2 — The Right Way: Sign the Modules and Enroll a MOK","level":2},"tunes":{"alignTune":"left"}},{"id":"cYxWkRtjPQ","type":"paragraph","data":{"text":"Machine Owner Keys (MOK) let you sign your own kernel modules so they're trusted by Secure Boot. This approach keeps your security posture intact and is the recommended long-term solution."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"TlufZizYsT","type":"header","data":{"text":"Step 1: Install the Required Tools","level":3},"tunes":{"alignTune":"left"}},{"id":"4OLL5Wfs2w","type":"paragraph","data":{"text":"On Ubuntu or Debian:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"URFbwOBMZB","type":"code","data":{"code":"sudo apt update\nsudo apt install openssl mokutil build-essential dkms linux-headers-$(uname -r)"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"rtGCesvHVR","type":"header","data":{"text":"Step 2: Generate a Signing Key","level":3},"tunes":{"alignTune":"left"}},{"id":"wCOtWf4QWy","type":"code","data":{"code":"mkdir -p ~/module-signing\ncd ~/module-signing\nopenssl req -new -x509 -newkey rsa:2048 \\\n -keyout MOK.priv \\\n -outform DER \\\n -out MOK.der \\\n -nodes -days 36500 \\\n -subj \"/CN=VMware Module Signing/\""},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"1psrCrJpvo","type":"paragraph","data":{"text":"This creates two files:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"z4CXGk4LdK","type":"list","data":{"style":"unordered","items":["MOK.priv — your private signing key (keep this safe)","MOK.der — the public certificate you'll enroll into the firmware"]},"tunes":{"alignTune":"left"}},{"id":"c_kVYXPXlp","type":"header","data":{"text":"Step 3: Enroll the Key","level":3},"tunes":{"alignTune":"left"}},{"id":"C_AEp_2FDo","type":"code","data":{"code":"sudo mokutil --import ~/module-signing/MOK.der"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"0WPpcNOTeO","type":"paragraph","data":{"text":"You'll be asked to create a one-time password — remember it, you'll need it on the next boot."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"cq_auW4P4N","type":"header","data":{"text":"Step 4: Complete Enrollment at Boot","level":3},"tunes":{"alignTune":"left"}},{"id":"QdSaqmmRKg","type":"paragraph","data":{"text":"Reboot your machine. You'll be presented with the MOK Manager screen. Navigate through:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"hLBljchNBk","type":"list","data":{"style":"ordered","items":["Enroll MOK","Continue","Yes","Enter the password you just created","Reboot"]},"tunes":{"alignTune":"left"}},{"id":"qfLE_2Jgn0","type":"header","data":{"text":"Step 5: Locate the VMware Module Files","level":3},"tunes":{"alignTune":"left"}},{"id":"2RF7o6MwyX","type":"code","data":{"code":"modinfo -n vmmon\nmodinfo -n vmnet"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"H7aC7kGzm1","type":"paragraph","data":{"text":"If those commands don't return paths yet, find them manually:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"hOxNkfNQN9","type":"code","data":{"code":"find /lib/modules/$(uname -r) -type f | grep -E 'vmmon|vmnet'"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"mtHfV3w_e4","type":"paragraph","data":{"text":"Typical paths look like:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"aPXZOnvL56","type":"code","data":{"code":"/lib/modules//misc/vmmon.ko\n/lib/modules//misc/vmnet.ko"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"ZFz7Lshd5z","type":"header","data":{"text":"Step 6: Sign the Modules","level":3},"tunes":{"alignTune":"left"}},{"id":"m_zTMwzA3f","type":"paragraph","data":{"text":"First, find the kernel's signing tool:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"XRVfoYNP1s","type":"code","data":{"code":"find /usr/src/linux-headers-$(uname -r) -name sign-file"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"w2KoiNczTt","type":"paragraph","data":{"text":"Then sign both modules:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"d1TaiSHXRl","type":"code","data":{"code":"sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 \\\n ~/module-signing/MOK.priv \\\n ~/module-signing/MOK.der \\\n $(modinfo -n vmmon)\n\nsudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 \\\n ~/module-signing/MOK.priv \\\n ~/module-signing/MOK.der \\\n $(modinfo -n vmnet)"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"ZkN9nVuKNv","type":"quote","data":{"text":"If modinfo -n doesn't return a path, replace $(modinfo -n vmmon) with the full path you found in Step 5.","caption":"","alignment":"left"},"tunes":{"alignTune":"left"}},{"id":"5mR4w-kc_S","type":"header","data":{"text":"Step 7: Load the Modules and Start VMware","level":3},"tunes":{"alignTune":"left"}},{"id":"fBn42-oX-4","type":"code","data":{"code":"sudo depmod -a\nsudo modprobe vmmon\nsudo modprobe vmnet"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"ODYdvRG3Jv","type":"paragraph","data":{"text":"Verify they loaded:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"Peu-SH6EZ4","type":"code","data":{"code":"lsmod | grep -E 'vmmon|vmnet'"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"o0tCli6YdW","type":"paragraph","data":{"text":"Then restart VMware:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"WODUf7PhsP","type":"code","data":{"code":"sudo systemctl restart vmware"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"m8W_LgkjfS","type":"delimiter","data":{},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"3vLYe-4EQM","type":"header","data":{"text":"One Important Caveat","level":2},"tunes":{"alignTune":"left"}},{"id":"iVgY371BuZ","type":"paragraph","data":{"text":"The module signatures don't survive automatically. If any of the following happen, you'll need to re-sign vmmon and vmnet:"},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"Shau9VJHyF","type":"list","data":{"style":"unordered","items":["A kernel update is installed","A VMware update rebuilds the modules","You manually run vmware-modconfig again"]},"tunes":{"alignTune":"left"}},{"id":"UvnymkZf1x","type":"paragraph","data":{"text":"Keep your MOK.priv and MOK.der files in a safe location so you can re-sign quickly when needed."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"fD74Gd70G2","type":"delimiter","data":{},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"4uF-XLhNN-","type":"header","data":{"text":"Which Option Should You Choose?","level":2},"tunes":{"alignTune":"left"}},{"id":"LI-9hVzgOe","type":"table","data":{"withHeadings":true,"content":[["","Disable Secure Boot","Sign with MOK"],["Setup time","~5 minutes","~20 minutes"],["Ongoing maintenance","None","Re-sign after kernel/VMware updates"],["Security","Reduced","Maintained"],["Best for","Dev machines, home labs","Production, security-conscious setups"]]},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"eJTQT__y1T","type":"delimiter","data":{},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"leqI8LLaHh","type":"header","data":{"text":"Wrapping Up","level":2},"tunes":{"alignTune":"left"}},{"id":"MfjYG9Fuxd","type":"paragraph","data":{"text":"VMware and Secure Boot can absolutely coexist — it just takes a bit of extra setup. If you're running this on a personal dev box, disabling Secure Boot is a perfectly reasonable call. If you want to keep your system locked down, the MOK signing approach gives you VMware plus full Secure Boot protection."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}},{"id":"e5jgp9gw55","type":"paragraph","data":{"text":"Either way, run mokutil --sb-state first — it'll confirm in seconds whether Secure Boot is actually the root cause before you dig deeper."},"tunes":{"alignTune":"left","styleTune":{},"visTune":{}}}],"version":"2.28.2"}