The test was conducted on a fresh Ubuntu Focal VM. I attached the machine to Ubuntu Pro, enabled FIPS channels, and rebooted specifically into the outdated FIPS kernel (-1024) to test the upgrade path: ``` # Attach Pro and enable FIPS pro attach <my-token> pro enable fips --assume-yes pro enable fips-updates --assume-yes
# Upgrade system and configure GRUB to boot into the older FIPS kernel apt upgrade -y grub-reboot '1>2' # Boots into the 5.4.0-1024-fips kernel reboot ``` After the reboot, I verified that the system was running the target FIPS kernel and that FIPS mode was successfully enabled: ``` root@couve:~# uname -a Linux couve 5.4.0-1024-fips #28+recert1-Ubuntu SMP Fri May 14 21:30:13 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux root@couve:~# sysctl crypto crypto.fips_enabled = 1 ``` I attempted to upgrade the system to Jammy: ``` do-release-upgrade --proposed ``` As expected, the upgrade was successfully intercepted and cancelled. The tool correctly identified the outdated FIPS kernel and prevented the upgrade, displaying the following warning: ``` Reading cache Checking package manager Reading package lists... Done Building dependency tree Reading state information... Done Hit http://security.ubuntu.com/ubuntu focal-security InRelease Hit http://archive.ubuntu.com/ubuntu focal InRelease Hit http://archive.ubuntu.com/ubuntu focal-updates InRelease Hit http://archive.ubuntu.com/ubuntu focal-backports InRelease Hit https://esm.ubuntu.com/apps/ubuntu focal-apps-security InRelease Hit https://esm.ubuntu.com/apps/ubuntu focal-apps-updates InRelease Hit https://esm.ubuntu.com/infra/ubuntu focal-infra-security InRelease Hit https://esm.ubuntu.com/infra/ubuntu focal-infra-updates InRelease Hit https://esm.ubuntu.com/fips-updates/ubuntu focal-updates InRelease Fetched 0 B in 6s (0 B/s) Reading package lists... Done Building dependency tree Reading state information... Done You are running an outdated FIPS kernel version. The running kernel version is incompatible with the Jammy FIPS userspace packages in FIPS mode. An upgrade in this scenario will fail. If you wish to upgrade your system, you must either boot in non-FIPS mode or upgrade your kernel to the latest one available in the fips-updates channel. Restoring original system state Aborting Reading package lists... Done Building dependency tree Reading state information... Done === Command detached from window (Thu Jul 2 13:40:20 2026) === === Command terminated with exit status 1 (Thu Jul 2 13:40:30 2026) === ``` ** Tags removed: verification-needed-jammy ** Tags added: verification-done-jammy -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055825 Title: fips-updates: upgrade from 20.04 to 22.04 fails To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2055825/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
