OpenVPN · DKMS

dkms "failed for ovpn-dco" after the kernel 7.0 update: your new kernel is fine

Published 2026-11-10 · HardStacked · 9 min

You updated Ubuntu 24.04 (its HWE kernel is now 7.0: 7.0.0-42 reached noble-updates on 2026-10-28) or Ubuntu 26.04, and apt stops with dkms autoinstall on 7.0.0-42-generic/aarch64 failed for ovpn-dco(10), then run-parts: /etc/kernel/header_postinst.d/dkms exited with return code 11. dpkg blames linux-headers-7.0.0-42-generic, and every apt command after that replays the error. An Ask Ubuntu question titled "something about openvpn is preventing my linux image from updating properly" (question 1570270, October 2026, kernel 7.0.0-38-generic, package ovpn-dco 0.2.20260526-1+26.1) shows the same errors as our test, and its build log shows a 24.04 toolchain (gcc-13 13.3.0-6ubuntu2~24.04.1).

Your new kernel is not broken. The culprit is openvpn-dco-dkms, a module that Linux has shipped in its own tree since 6.16 (the ovpn module). Removing that one package repairs apt. What decides afterwards whether your tunnel keeps data channel offload (DCO) is no longer a module to compile, it is the OpenVPN version.

The one answer to that question (score -1, not accepted) says to boot an older kernel, purge the new kernel, purge openvpn3-client, openvpn, openvpn-dco-dkms and the NetworkManager OpenVPN plugins, then reinstall the kernel. It costs you the kernel and the whole VPN stack to get rid of one package. We measured that one package is enough.

Measured on fresh Ubuntu 24.04.5 LTS and Ubuntu 26.04.1 LTS virtual machines (arm64, official cloud images), on 2026-11-10. Before the 24.04 capture the machine had Ubuntu's openvpn and openvpn-dco-dkms installed on kernel 6.8, which is probably your starting point.

01. What apt says, and what actually failed

Starting state, then the upgrade to the 7.0 HWE kernel. We cut download and unpacking lines, firmware packages and debconf noise, never a command.

First liar: dpkg names the headers and the HWE meta-packages. The kernel image was unpacked and set up (look at the /boot/vmlinuz and initrd.img lines), then the same DKMS hook ran again from its trigger and failed again. On another run of ours the image configured fine, so read it as: dpkg may also list the kernel image. In both cases the failing thing is the hook, not the kernel.

02. Your new kernel already has the module

Ask dpkg what is stuck, read the build log, then ask the new kernel, even though you have not booted it (modinfo -k).

The two compile errors are the same as in the Ask Ubuntu question (we are on arm64, they are on x86_64, same source code). The old out-of-tree driver calls kernel functions whose signatures changed. And intree Y: kernel 7.0 ships its own ovpn, in kernel/drivers/net/ovpn/. The package is trying to build a second copy of something the kernel already has.

03. Fix apt: remove one package

The purge finishes the kernel configuration by itself: you see Setting up linux-image-…, Setting up linux-headers-… and dkms: autoinstall … done, once the broken hook has nothing left to build. So dpkg --configure -a prints nothing, nothing left to do, which is the point. Keep it anyway as a safety net. The audit is clean, dkms status is empty, and the kernel and OpenVPN are still installed. Note that the purge also deletes the module built for the old 6.8 kernel. apt now offers to autoremove dkms itself, your call.

04. After the reboot: does your tunnel still use DCO?

We run sudo reboot, then load the kernel's module by hand and ask OpenVPN 2.6, the version Ubuntu 24.04 ships:

Second liar. The module is loaded and OpenVPN 2.6 still says DCO version: N/A. We then ran a real tunnel (two network namespaces, a throwaway PKI). The client log says Note: Kernel support for ovpn-dco missing, disabling data channel offload., while modinfo says the support is there. OpenVPN 2.6 looks for the old out-of-tree module and does not know how to talk to the new one. OpenVPN's README.dco lists this very message for when the kernel module is not usable. The tunnel comes up anyway, without DCO: ip -d link shows an interface of type tun.

According to the OpenVPN project (blog post "openvpn-dco-added-to-linux-kernel-2025"), DCO went into the official Linux kernel starting with 6.16, and their README.dco says the in-kernel ovpn module only works with OpenVPN 2.7 and later. For older kernels they point to a separate backports project (ovpn-backports). Ubuntu's versions, read on Launchpad on 2026-11-10: 24.04 has openvpn 2.6.19, 26.04 has 2.7.0.

So on 24.04 you have two choices. Live without DCO, the tunnel works. Or move to OpenVPN 2.7: we measured 2.7.9 from the isv:OpenVPN repository on the openSUSE Build Service, which publishes OpenVPN 2.7 for Ubuntu 24.04 (we did not check who maintains it, so we do not give the commands to add it). With it, the log says DCO version: 7.0.0-42-generic #42~24.04.1-Ubuntu ..., then DCO device tun0 opened, and the interface type is ovpn.

Last surprise, the one that stops the "just update the DKMS" reflex. The same repository also ships a recent openvpn-dco-dkms (0.2.20261109, a snapshot dated 2026-11-09 by its version number). It does compile on 7.0, with no error. But OpenVPN 2.7.9 never loads it: modinfo -n ovpn returns /lib/modules/7.0.0-42-generic/kernel/drivers/net/ovpn/ovpn.ko.zst, the kernel's module, and the DKMS built an ovpn-dco-v2.ko.zst that stays unused. Even when it compiles, the package is useless on 7.0.

The +26.1 suffix of the package in the question looks like the form used by that repository's packages on the openSUSE Build Service (isv:OpenVPN). That is an inference.

05. On Ubuntu 26.04, the package fails on install

26.04 already runs kernel 7.0, so the DKMS package fails the moment you install it:

Look at the description in dpkg --audit: "for OpenVPN 2.6", on a release that ships OpenVPN 2.7. The package is obsolete and Ubuntu still ships it. Here nothing is lost by removing it: OpenVPN 2.7.0 talks to the kernel's module. In a real tunnel on another fresh 26.04 machine of ours the log says DCO version: 7.0.0-38-generic ... then DCO device tun0 opened, interface type ovpn, after the purge and with no option set.

06. What we did not measure

x86_64: our machines are arm64, the compile errors are the same as in the question, so we infer the same source code fails the same way. Secure Boot and MOK enrolment, the NetworkManager OpenVPN plugin and openvpn3-linux: not measured, and the Ask Ubuntu answer purges them too. Debian 13: not measured. It keeps a 6.12 kernel, so the DKMS package should stay useful there (inferred from the kernel version). Throughput and latency with and without DCO: we did not measure those and say nothing about them.

Same family, another OpenVPN trap: OpenVPN "CA signature digest algorithm too weak" when your CA is SHA-256.