Rebuilding initramfs to exit emergency mode after a kernel update on Ubuntu 24.04 -

Rebuilding the initramfs is the most reliable way to escape an emergency shell after a kernel upgrade that leaves the system stuck in emergency mode.
The problem usually stems from a mismatch between the running kernel and the modules or hooks that the initramfs contains.
Below is a step‑by‑step guide that covers the common causes, the exact commands you’ll run, and the security‑aware trade‑offs you should keep in mind.

Why Emergency Mode Happens After a Kernel Update

When you install a new kernel on Ubuntu 24.04, GRUB points to the new image, but the initramfs that ships with it must contain:

the exact set of kernel modules required to mount the root filesystem,
the correct init scripts (e.g., for LVM, Btrfs, or encrypted LUKS),
any custom hooks you added in /etc/initramfs-tools/hooks/.

If any of these pieces are missing or corrupted, systemd will drop you into emergency mode.
Typical triggers:

Trigger	What goes wrong	Typical symptom
Missing module	`initramfs-tools` didn’t pick up a module that the new kernel needs (e.g., `nvme` for NVMe drives)	`Failed to mount root fs on /dev/nvme0n1p1`
Incorrect initrd	The initramfs was built for a different kernel version or with wrong `initrd` hooks	`Failed to load initramfs`
Filesystem corruption	The root partition is damaged and the initramfs can’t recover	`Failed to mount root fs` + `Filesystem errors detected`
Encrypted root	The initramfs lacks the `cryptsetup` hook or the keyfile	`cryptsetup: failed to open LUKS container`

Quick Diagnostics

1. Inspect the journal

Boot into the emergency shell, then run:

journalctl -xb | less

Look for lines that start with Failed to or systemd: Failed to.
These messages usually point directly to the missing module or hook.

2. Verify the root device

lsblk -f

Make sure the device listed as root in /etc/fstab matches the one systemd is trying to mount.
If you’re using LVM or LUKS, double‑check the logical volume names.

3. Check the initramfs contents

lsinitrd /boot/initrd.img-$(uname -r) | grep -i nvme

If you’re missing a module you expect, that’s a sign the initramfs is incomplete.

Rebuilding the initramfs

Ubuntu ships the initramfs-tools package, which provides the update-initramfs command.
The safest way to rebuild is to run it against the kernel that’s currently failing.

# Identify the failing kernel
uname -r          # e.g., 6.8.0-24-generic

# Rebuild the initramfs for that kernel
sudo update-initramfs -u -k 6.8.0-24-generic

-u tells it to update an existing initramfs; -k specifies the kernel version.
If you want to rebuild for all installed kernels, use -c to create new ones:

sudo update-initramfs -c -k all

1. Verify the new initramfs

lsinitrd /boot/initrd.img-6.8.0-24-generic | grep -i cryptsetup

If the expected modules appear, the rebuild was successful.

2. Re‑install the kernel package

Sometimes the kernel package itself is incomplete. Re‑installing forces a clean install of the kernel headers and modules:

sudo apt-get install --reinstall linux-image-6.8.0-24-generic

After that, rebuild the initramfs again.

Handling Encrypted Root or LVM

If your root filesystem is encrypted with LUKS or uses LVM, the initramfs must contain the appropriate hooks.

# Ensure the cryptsetup hook is present
grep -q cryptsetup /etc/initramfs-tools/modules

If it’s missing, add it:

echo "cryptsetup" | sudo tee -a /etc/initramfs-tools/modules
sudo update-initramfs -u -k 6.8.0-24-generic

For LVM, the hook is usually included automatically, but verify:

grep -q lvm /etc/initramfs-tools/modules

If you use a custom keyfile, double‑check its path in /etc/crypttab and ensure it’s copied into the initramfs:

sudo mkdir -p /etc/initramfs-tools/conf.d
echo "keyfile" | sudo tee /etc/initramfs-tools/conf.d/keyfile
sudo update-initramfs -u -k 6.8.0-24-generic

Keeping Multiple Kernels

Ubuntu keeps the last three kernels by default. This is a safety net: if a new kernel breaks, you can boot the previous one.

sudo apt-get remove linux-image-6.8.0-24-generic
sudo apt-get install linux-image-6.8.0-22-generic

After booting the older kernel, rebuild its initramfs as shown above.
Once you’re confident the new kernel works, you can purge the old one.

Security‑Aware Trade‑offs

Trade‑off	Description	Recommendation
Signed kernels	Ubuntu’s kernels are signed by Canonical. If you use custom kernels, you’ll need to sign them yourself or disable Secure Boot.	Keep the default signed kernels unless you have a compelling reason to build your own.
Minimal initramfs	Stripping unused modules reduces the attack surface.	Use `/etc/initramfs-tools/conf.d/initramfs.conf` to set `MODULES=most` or `MODULES=dep` instead of `all`.
Secure boot	Prevents unsigned kernels from booting.	If you enable Secure Boot, ensure your initramfs contains the necessary keys.
Encryption	LUKS adds a layer of confidentiality.	Keep keyfiles in a secure location and restrict permissions (`chmod 600`).

Troubleshooting Checklist

Boot with an older kernel
If the new kernel fails, select the previous one from the GRUB menu (e key → change linux line → linux /boot/vmlinuz-6.8.0-22-generic ...).
Re‑run update-initramfs with the failing kernel
```
sudo update-initramfs -u -k $(uname -r)
```

Re‑install the kernel package

sudo apt-get install --reinstall linux-image-$(uname -r)

Check that all required modules are listed

lsinitrd /boot/initrd.img-$(uname -r) | grep -i <module>

**Verify

linux open-source