Install NVIDIA Drivers on Fedora 45 / 44 (Secure Boot and Legacy GPUs)

Install the NVIDIA driver on a Secure Boot machine without enrolling a key and the module never loads. The akmod build finishes, nvidia-smi fails, and the kernel log says the key was rejected. Nothing in the dnf output warns you. On a GTX 900, GTX 10 series or Volta card such as the Titan V there is a second trap: the current driver package no longer supports those GPUs, so it builds a module the card can’t use.

Original content from computingforgeeks.com - post 68983

This guide shows how to install NVIDIA drivers on Fedora 45 and Fedora 44 from RPM Fusion with akmod-nvidia, then confirm CUDA works without installing the toolkit. It covers the Secure Boot MOK enrollment step with the real MokManager screens, how the package picks between the open and proprietary kernel modules, and the akmod-nvidia-580xx legacy driver for Maxwell, Pascal and Volta cards. Every error below except the nouveau fallback message came from our own lab machines, with the fix we used.

Tested October 2026 on Fedora 45 and Fedora 44 with a Tesla T4, and on Fedora 45 VMs for Secure Boot and the driver branch swap.

Which NVIDIA driver package your GPU needs

Pick the package by GPU generation, not by what a forum post installed three years ago. On Fedora 45, RPM Fusion nonfree carries four driver branches, and only one of them fits a given card:

GPU generation	Example cards	Package	Kernel module built
Turing and newer	GTX 16 series, RTX 20 to RTX 50, Tesla T4, A10G, L4	akmod-nvidia	Open
Maxwell, Pascal, Volta	GTX 750 Ti, GTX 900, GTX 10 series, Titan V, Tesla V100, Quadro GV100	akmod-nvidia-580xx	Proprietary on these cards, open on Turing and newer
Kepler	GTX 600, GTX 700 (most)	akmod-nvidia-470xx	Proprietary, Xorg only
Fermi	GTX 400, GTX 500	akmod-nvidia-390xx	Proprietary, Xorg only

The 580xx row is the one that bites people after an upgrade. NVIDIA’s own supported-gpus.json, shipped inside the current driver source, marks 305 entries with "legacybranch": "580.xx". The GTX 980 and the GTX 1080 (PCI ID 10de:1b80) are both in that list, which means the current driver does not support them. Volta belongs in the same row: NVIDIA’s deprecation schedule names 580 as the last branch for Maxwell, Pascal and Volta, and the 580xx package’s own list of GPUs that need the proprietary module includes the Tesla V100 (10de:1db4). We tested the current and 580xx packages on a Turing card. The 470xx and 390xx rows follow the RPM Fusion NVIDIA howto, and we did not run them on hardware. RPM Fusion supports both only on the current stable Xorg server (its howto words the 580xx row the same way, and we did not test a Wayland desktop on 580xx), and 390xx is end of life at NVIDIA, kept on a best-effort basis that a newer kernel can break. Fedora Workstation’s GNOME session is Wayland only, so treat a Kepler or Fermi desktop on Fedora 45 as unsupported.

Step 1: Identify the GPU and check Secure Boot

You need a Fedora 45 or Fedora 44 install with sudo access and a network connection to the RPM Fusion mirrors. Install pciutils first, then read the GPU’s PCI ID:

sudo dnf install -y pciutils
lspci -nn | grep -i nvidia

The ID in the last bracket (10de:1eb8 here) is what the driver package matches against:

00:1e.0 3D controller [0302]: NVIDIA Corporation TU104GL [Tesla T4] [10de:1eb8] (rev a1)

Now check whether Secure Boot is on. This single answer decides whether you need Step 3:

mokutil --sb-state

Our Secure Boot test VM reported it enabled. The cloud GPU hosts reported SecureBoot disabled with the firmware in setup mode, so they skipped Step 3:

SecureBoot enabled

Do not turn Secure Boot off to make the driver load. Enrolling one key costs a single extra reboot, and it keeps the boot chain verified.

Step 2: Enable RPM Fusion and boot the newest kernel

The driver lives in RPM Fusion nonfree, which needs the free repo as well. If you already enabled it for multimedia codecs on Fedora, skip the first command:

sudo dnf install -y https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm

Then bring the system fully up to date and install the akmods tooling in the same pass. mokutil and openssl are only needed with Secure Boot, but they cost nothing to have:

sudo dnf upgrade -y --refresh
sudo dnf install -y akmods mokutil openssl
sudo systemctl reboot

Do not skip this reboot. akmod builds against the newest installed kernel-devel, and akmod-nvidia pulls in a matching kernel-devel, which drags in a newer kernel if one is out. On our Fedora 44 host that happened during the 580xx swap described further down: the module was built for the new kernel while the old one was still running, and modinfo could not find a module for the running kernel until the next boot. The reboot also lets the akmods-keygen service run, which creates the signing key on first boot after akmods is installed.

Step 3: Enroll the akmods signing key for Secure Boot

With Secure Boot enforcing, the kernel loads only modules signed by a key in its keyring. akmods signs every module it builds with a machine-local key in /etc/pki/akmods/, so that key has to be enrolled in the MOK list once. On our VM the keygen service created it at boot, named after the host with a public_key.der symlink pointing at the current certificate. The directory is readable only by root and the akmods group, so check it with sudo ls /etc/pki/akmods/certs/. If that lists nothing, sudo kmodgenca -a generates the key by hand, which is the command the RPM Fusion Secure Boot howto gives. The private key sits on disk next to it, so anyone who can read it can sign modules your firmware will trust. Keep the root filesystem encrypted. Confirm the firmware does not trust the key yet:

sudo mokutil --test-key /etc/pki/akmods/certs/public_key.der

A fresh key reports that it is not enrolled:

/etc/pki/akmods/certs/public_key.der is not enrolled

Queue it for enrollment. mokutil asks for a one-time password twice. You type it again at the firmware screen, where the keyboard is mapped to QWERTY, so keep it short and avoid symbols if your layout is not QWERTY:

sudo mokutil --import /etc/pki/akmods/certs/public_key.der

Check the pending request as root. Without sudo, mokutil --list-new prints nothing and exits 0, which looks exactly like a failed import:

sudo mokutil --list-new | grep -E "^\[key|SHA1 Fingerprint|Subject:|Not After"

Note the fingerprint. You compare it against the firmware screen in a minute:

[key 1]
SHA1 Fingerprint: 2f:e6:38:5c:65:0e:83:bc:75:bb:3b:c9:ae:09:50:ce:97:c7:a5:30
            Not After : Sep 27 20:11:33 2036 GMT
        Subject: O=sb-lab01, OU=sb-lab01/emailAddress=akmods@sb-lab01, L=None, ST=None, C=US, CN=sb-lab01_1790799093_60a3708c

Reboot and stay at the console. Shim shows a short “Press any key” countdown before MokManager opens. Press a key while it is up, because when it expires the boot continues without enrolling anything. In the MokManager menu, choose Enroll MOK:

Select View key 0 before you continue. This is the only point where you can check that the key you are about to trust is the one akmods generated. The fingerprint matched the mokutil output above:

Press Enter to go back, choose Continue, answer Yes to “Enroll the key(s)?”, type the password, then pick Reboot. Back in Fedora, the key is in the MOK list and the kernel loads it at boot:

The Secure Boot VM has no GPU, so modprobe still fails there, with could not insert 'nvidia': No such device, and dmesg logs NVRM: No NVIDIA GPU found. That pair is the proof the signature passed: the kernel accepted the module and the driver then looked for hardware. Before enrollment the same command stopped at the signature check. RPM Fusion tells you to enroll before installing the kmod, and that is the order above. On the lab VM we had built the driver first and enrolled afterwards, and the existing module loaded without a rebuild, because it was already signed with the same key. A firmware update can wipe the MOK list. If the driver stops loading after one, run the same mokutil --import again.

Step 4: Install the NVIDIA driver and wait for the module build

For a Turing or newer GPU, install the akmod and the CUDA user-space libraries. The -cuda package also carries nvidia-smi. GTX 900, GTX 10 and Volta owners: stop here and use the 580xx section further down instead. If you installed the driver as a dependency of something else, run sudo dnf mark user akmod-nvidia afterwards, or a later dnf autoremove can take the akmod and its compiler with it. On our hosts the explicit install had already marked it, and the command printed “Nothing to do.”

sudo dnf install -y akmod-nvidia xorg-x11-drv-nvidia-cuda

On the minimal Fedora 45 cloud image this pulled 393 packages, among them the compiler toolchain, kernel-devel and a stack of desktop libraries. Fedora 44 pulled 363. A Workstation install already has many of them. The summary lines from the Fedora 45 run:

Transaction Summary:
 Installing:       393 packages
Complete!

dnf returns before the kernel module exists. The akmod builds it in the background. Reboot in the middle of that build and the next boot has no module for its kernel, and since nouveau is already blacklisted, the GPU has no driver at all until a build completes. Wait for it:

until modinfo -F version nvidia >/dev/null 2>&1; do sleep 5; done; date +%T; modinfo -F version nvidia; modinfo -F license nvidia; ls /var/cache/akmods/nvidia/

The loop returned about two minutes after dnf finished on a 4 vCPU host. It checks the running kernel only, so if the install pulled in a newer kernel it never returns: use the newest-kernel loop from the 580xx section instead, with the last ls pointed at /var/cache/akmods/nvidia/. RPM Fusion puts a normal build at up to five minutes; if either loop is still waiting well past that, the build failed, and its log is in /var/cache/akmods/. The build log and the kmod RPM it produced sit in /var/cache/akmods/nvidia/:

20:33:43
615.71.09
Dual MIT/GPL
615.71.09-3-for-7.2.8-300.fc45.x86_64.log
kmod-nvidia-7.2.8-300.fc45.x86_64-615.71.09-3.fc45.x86_64.rpm

After the install, the boot command line blacklists the in-kernel drivers on both releases: nouveau and nova_core, the newer Rust driver for recent NVIDIA GPUs:

sudo grubby --info=DEFAULT | grep ^args

Both names appear twice, once for the initramfs and once for the running system:

args="ro rootflags=subvol=root no_timer_check console=tty1 console=ttyS0,115200n8 systemd.firstboot=off rootflags=subvol=root rd.driver.blacklist=nouveau,nova_core modprobe.blacklist=nouveau,nova_core"

Step 5: Reboot and verify the driver and CUDA

Reboot once the module exists:

sudo systemctl reboot

After the reboot, nvidia, nvidia_modeset, nvidia_drm and nvidia_uvm are loaded, nouveau is not, and nvidia-smi sees the card:

The header changed in the current driver branch. It now reads KMD Version and CUDA UMD Version, where the 580xx driver still prints Driver Version and CUDA Version. Scripts that grep the old labels need updating.

nvidia-smi working does not prove CUDA works. A short Python script that calls the CUDA driver API directly does, without installing the CUDA toolkit. Create it:

vim ~/cuda-check.py

Paste this. It creates a context on each GPU and allocates 256 MiB of device memory:

import ctypes
cuda = ctypes.CDLL("libcuda.so.1")
assert cuda.cuInit(0) == 0
n = ctypes.c_int(); cuda.cuDeviceGetCount(ctypes.byref(n))
v = ctypes.c_int(); cuda.cuDriverGetVersion(ctypes.byref(v))
print(f"CUDA driver API {v.value // 1000}.{(v.value % 1000) // 10}, devices: {n.value}")
for i in range(n.value):
    dev = ctypes.c_int(); cuda.cuDeviceGet(ctypes.byref(dev), i)
    name = ctypes.create_string_buffer(100); cuda.cuDeviceGetName(name, 100, dev)
    mem = ctypes.c_size_t(); cuda.cuDeviceTotalMem_v2(ctypes.byref(mem), dev)
    ma, mi = ctypes.c_int(), ctypes.c_int()
    cuda.cuDeviceGetAttribute(ctypes.byref(ma), 75, dev); cuda.cuDeviceGetAttribute(ctypes.byref(mi), 76, dev)
    ctx = ctypes.c_void_p(); rc = cuda.cuCtxCreate_v2(ctypes.byref(ctx), 0, dev)
    free, total = ctypes.c_size_t(), ctypes.c_size_t(); cuda.cuMemGetInfo_v2(ctypes.byref(free), ctypes.byref(total))
    ptr = ctypes.c_uint64(); arc = cuda.cuMemAlloc_v2(ctypes.byref(ptr), 256 * 1024 * 1024)
    print(f"GPU {i}: {name.value.decode()}, compute {ma.value}.{mi.value}, {mem.value // 2**20} MiB, context rc={rc}, 256 MiB alloc rc={arc}")
    cuda.cuMemFree_v2(ptr); cuda.cuCtxDestroy_v2(ctx)

Run it as your normal user:

python3 cuda-check.py

Both return codes must be 0. Anything else means the user-space libraries and the kernel module disagree:

CUDA driver API 13.4, devices: 1
GPU 0: Tesla T4, compute 7.5, 14927 MiB, context rc=0, 256 MiB alloc rc=0

Tools that bundle their own CUDA runtime, such as the PyTorch pip wheels, need only this driver. Compiling CUDA code needs NVIDIA’s toolkit on top, and the CUDA on Ubuntu guide covers that side. For long-running GPU hosts, wire the card into DCGM, Prometheus and Grafana monitoring. nvidia-persistenced is installed but inactive by default, so enable it on headless compute boxes if you want the GPU kept initialized between jobs.

Our GPU hosts were headless cloud instances with a datacenter card that has no display outputs, so this lab did not test a GNOME or KDE session on the driver. The kernel module, nvidia-smi and CUDA paths above are what we verified.

Open or proprietary kernel module: what akmod builds

You don’t choose the module flavor at install time. The RPM Fusion kmod spec ships both kernel and kernel-open source trees and runs a detection script during the build. The script reads lspci and compares every NVIDIA PCI ID against a list of GPUs the open module does not support. A match builds the proprietary module, and no match builds the open one. The build log records the decision:

Check your own machine the same way after the build:

grep -E "Runtime detection|matching graphics|Using nvidia-open|Not using" /var/cache/akmods/nvidia/*.log | tail -3

On the T4 it picked the open module:

2026/09/30 20:38:57 akmodsbuild: Runtime detection of kmod_nvidia_open
2026/09/30 20:38:57 akmodsbuild: No matching graphics card found.
2026/09/30 20:38:57 akmodsbuild: Using nvidia-open

modinfo -F license nvidia gives the same answer at a glance: the open module reports Dual MIT/GPL. The two branches differ in one way that matters. In the current akmod-nvidia the exclusion list is empty, since every GPU that branch still supports is Turing or newer. In akmod-nvidia-580xx the list has 160 PCI IDs, among them the GTX 1080’s 10de:1b80 and the Tesla V100’s 10de:1db4. That is how one 580xx package serves both a GTX 1080 (proprietary) and a Turing card (open). The choice is made once, when the module is built, so after a GPU swap or a move to another machine the old flavor stays until sudo akmods --rebuild runs.

GTX 900, GTX 10 series and Volta: install the 580xx legacy driver

On a clean system, install the legacy branch directly instead of Step 4:

sudo dnf install -y akmod-nvidia-580xx xorg-x11-drv-nvidia-580xx-cuda

Wait for the build with a loop that checks the newest installed kernel instead of the running one. A driver install can pull in a newer kernel, and the module then exists only for that kernel until you reboot, so the plain loop from Step 4 would wait forever:

K=$(rpm -q --qf "%{VERSION}-%{RELEASE}.%{ARCH}\n" kernel-core | sort -V | tail -1); until modinfo -k $K nvidia >/dev/null 2>&1; do sleep 5; done; date +%T; echo $K; modinfo -k $K -F version nvidia; modinfo -k $K -F license nvidia; ls /var/cache/akmods/nvidia-580xx/

On the Fedora 45 test VM it returned about a minute after dnf finished, with the 580xx kmod built for the newest kernel:

21:18:34
7.2.8-300.fc45.x86_64
580.178.04
Dual MIT/GPL
580.178.04-1-for-7.2.8-300.fc45.x86_64.log
kmod-nvidia-580xx-7.2.8-300.fc45.x86_64-580.178.04-1.fc45.x86_64.rpm

Reboot once it returns. If the current driver is already installed, which is what happens when a GTX 1080 owner follows an old guide, the obvious swap fails. --allowerasing plans to remove six packages but leaves xorg-x11-drv-nvidia-libs and xorg-x11-drv-nvidia-cuda-libs in place, and the RPM transaction then dies on file conflicts. It failed the same way on Fedora 44 and Fedora 45. Remove the current branch with the glob RPM Fusion documents, then install 580xx. This full swap ran on a Fedora 45 VM, where the packages and the module build need no GPU:

The working sequence is two commands and a reboot:

sudo dnf remove "xorg-x11-drv-nvidia*"
sudo dnf install -y akmod-nvidia-580xx xorg-x11-drv-nvidia-580xx-cuda

The remove stops for confirmation, so read the list before you answer. It took 246 packages, everything the driver install had pulled in, including akmod-nvidia, the kmod and nvidia-settings, and it left nvidia-gpu-firmware alone. Don’t widen the pattern to "*nvidia*". That glob also matches nvidia-gpu-firmware, the firmware nouveau and nova_core load, which linux-firmware recommends and Fedora Workstation installs. The RPM Fusion howto warns that any other removal command takes packages the free driver still needs. The 580xx install then pulled 242 packages back with no conflicts. The remove had taken nvidia-modprobe and nvidia-persistenced as unused dependencies, and the 580xx install pulled the same branch-independent 615 builds of both back in. It also swaps nvidia-settings for nvidia-settings-580xx.

An earlier run of the swap on the Fedora 44 GPU host taught two more things. There the 580xx install also brought in a newer Fedora 44 kernel, so the module was built for that kernel and only loaded after the reboot. On the T4 the 580xx package built the open module, and CUDA reported driver API 13.0 instead of 13.4. On a real Pascal or Volta card the detection script picks the proprietary module from its exclusion list. We could not run that on hardware in this lab.

What happens on a kernel update

akmods.service is enabled by default and runs on every boot. It checks that a kmod exists for the booted kernel and builds one if it doesn’t. On a boot where nothing changed it finishes in about a second:

sudo journalctl -b -u akmods --no-pager | tail -3

The journal from our Fedora 45 host after the driver reboot:

Sep 30 20:35:13 gpu-lab01 systemd[1]: Starting akmods.service - Builds and install new kmods from akmod packages...
Sep 30 20:35:14 gpu-lab01 akmods[707]: Checking kmods exist for 7.2.8-300.fc45.x86_64 [  OK  ]
Sep 30 20:35:14 gpu-lab01 systemd[1]: Finished akmods.service - Builds and install new kmods from akmod packages.

An akmod install builds for the newest installed kernel, as the Fedora 44 swap showed, and a kernel that arrives later gets its kmod from akmods.service on the first boot into it. The risk is a module that built but is broken, or a build that failed. Here --force does not do what most people expect. It retries builds that failed earlier, and on a working system it only checks, returning in 0.1 seconds. To actually recompile for the running kernel, use --rebuild:

sudo akmods --rebuild --kernels $(uname -r)

It rebuilt and installed the module in 2 minutes 8 seconds:

Checking kmods exist for 7.2.8-300.fc45.x86_64 [  OK  ]
Building and installing nvidia-kmod [  OK  ]

real	2m8.481s
user	6m24.871s
sys	0m55.476s

Keep at least one older kernel installed (Fedora keeps three by default) so a failed build never leaves you without a bootable fallback. A release upgrade replaces the kernel too, so read the Fedora 44 to 45 upgrade guide before you move a GPU workstation across.

Driver errors from the lab, and the fix for each

Each of these came up on the lab machines, except the nouveau fallback message, which we read from its unit file. Match the exact text before you apply a fix.

modprobe: ERROR: could not insert ‘nvidia’: Key was rejected by service

Secure Boot is on and the akmods key is not enrolled. The module is signed, by a key the firmware has never seen, and dmesg adds “Loading of module with unavailable key is rejected”:

The signer field matches the akmods key name, so the build is fine. Do Step 3 and reboot. You don’t need to rebuild the module.

modinfo: ERROR: Module nvidia not found

Right after dnf finishes, this just means the akmod build is still running. Wait with the loop from Step 4. If it persists, compare uname -r with rpm -q kernel-devel. During the 580xx swap on our Fedora 44 host, the install pulled a newer kernel, and the module existed only for that one:

modinfo -k $(rpm -q --qf "%{VERSION}-%{RELEASE}.%{ARCH}\n" kernel-core | sort -V | tail -1) -F version nvidia

A version string here means the module is waiting for the newer kernel. Reboot into it:

580.178.04

file /usr/lib64/libcuda.so from install of xorg-x11-drv-nvidia-580xx-cuda-libs conflicts with file from package xorg-x11-drv-nvidia-cuda-libs

You tried to switch driver branches with --allowerasing. The resolver plans “Installing 8, Removing 6”, then the RPM transaction fails with “Transaction failed: Rpm transaction failed.” and a long list of file conflicts, because the -libs packages from the other branch stay installed. Remove the current branch with sudo dnf remove "xorg-x11-drv-nvidia*" first, as shown in the 580xx section. Nothing is half-installed after the failure: the transaction is rejected before any file changes.

NVIDIA kernel module missing. Falling back to nouveau

That message comes from nvidia-fallback.service, shipped in xorg-x11-drv-nvidia. It runs only when nouveau is blacklisted on the kernel command line and the nvidia module did not load:

systemctl cat nvidia-fallback.service

The unit loads nouveau and prints the message to the boot splash:

# /usr/lib/systemd/system/nvidia-fallback.service
[Unit]
Description=Fallback to nouveau as nvidia did not load
After=akmods.service
Before=display-manager.service
ConditionKernelCommandLine=rd.driver.blacklist=nouveau,nova_core
ConditionPathExists=!/sys/module/nvidia


[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=-/sbin/modprobe nouveau
ExecStartPost=-/bin/plymouth message --text="NVIDIA kernel module missing. Falling back to nouveau"


[Install]
WantedBy=graphical.target

It is a symptom, not the cause. The three causes we can account for are an unenrolled key (the first error above), a reboot before the build finished, and a GTX 900, GTX 10 or Volta card on the current akmod-nvidia, which needs the 580xx branch. The kernel log tells you which one you have:

sudo dmesg | grep -iE "nvidia|NVRM|rejected"

The unit’s preset is disabled, and it was disabled on all our hosts. So on a stock install, a failed load most likely leaves the GPU without a driver and never shows this message. We read that from the unit and its preset. No GPU host in the lab had a failed load.

mokutil –list-new prints nothing after an import

Run it with sudo. As a normal user it prints nothing and exits 0. That made our first import look like a failure when the request was already queued. sudo mokutil --test-key settles it: “already in the enrollment request” means reboot and finish in MokManager.

If the card is for games, gaming on Fedora picks up from here with Steam, Proton, NTSYNC and MangoHud on this driver. For the rest of a new Workstation build, the things to do after installing Fedora 45 list picks up where the driver leaves off. If you are installing from scratch, start with the Fedora 45 install guide, and if an old .run installer is still on the box, clear it out with the manual NVIDIA driver removal steps before you install the RPM Fusion packages.