On boot - getting message "failed to start early TPM SRK setup"

byron4120 · October 6, 2026, 3:50pm

for KDE-Linux on Boot getting message “failed to start early TPM SRK setup”

linnorm · October 6, 2026, 6:42pm

Operating System: KDE Linux 2026-10-05 16:10
KDE Plasma Version: 6.8.80
KDE Frameworks Version: 6.32.0
Qt Version: 6.11.2
Kernel Version: 7.2.8-arch1-2 (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 6800HS Creator Edition
Memory: 16 GiB of RAM (13,3 GiB usable)
Graphics Processor 1: AMD Ryzen 7 6800HS Creator Edition
Graphics Processor 2: NVIDIA GeForce RTX 3050 Laptop GPU
Manufacturer: LENOVO
Product Name: 82SN
System Version: IdeaPad 5 Pro 16ARH7

Experiencing the same since the 20261005245 image (Updated from 20261003245).

byron4120 · October 6, 2026, 9:33pm

My system is similar

Operating System: KDE Linux 2026-10-05 16:10
KDE Plasma Version: 6.8.80
KDE Frameworks Version: 6.32.0
Qt Version: 6.11.2
Kernel Version: 7.2.8-arch1-2 (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 9 6900HX with Radeon Graphics
Memory: 32 GiB of RAM (30.6 GiB usable)
Graphics Processor: AMD Radeon 680M
Manufacturer: Micro Computer (HK) Tech Limited
Product Name: Venus series
System Version: Version 1.0

Not sure when this started (10-03??)

Charlie_Ivermee · October 7, 2026, 10:19am

Same here and update failing.

Operating System: KDE Linux 2026-10-05 02:54
KDE Plasma Version: 6.8.80
KDE Frameworks Version: 6.32.0
Qt Version: 6.11.2
Kernel Version: 7.2.8-arch1-2 (64-bit)
Graphics Platform: Wayland
Processors: 8 × Intel® Core™ i5-10210U CPU @ 1.60GHz
Memory: 8 GiB of RAM (7.4 GiB usable)
Graphics Processor: Intel® UHD Graphics
Manufacturer: LENOVO
Product Name: 20S6000SUK
System Version: ThinkPad T15 Gen 1

jinliu · October 7, 2026, 10:42am

If KDE Linux is still based on Arch, then there are recent changes in both mkinitcpio and how the pcr policy in the UKI needs to be signed:

github.com/systemd/systemd

Failed to initialize NvPCR index: No such file or directory

opened 04:35PM - 22 Sep 26 UTC

VoSed

bug 🐛

### systemd version the issue has been seen with 262 ### Used distribution Ar…ch Linux ### Linux kernel version used _No response_ ### CPU architectures issue was seen on None ### Component _No response_ ### Expected behaviour you didn't see 0 failed units ### Unexpected behaviour you saw 4 failed units ### Steps to reproduce the problem Update systemd to version 262. Reboot ### Additional program output to the terminal or log subsystem illustrating the issue ```sh UNIT LOAD ACTIVE SUB DESCRIPTION ● systemd-pcrlogin@1000.service loaded failed failed TPM NvPCR Measurement of User Record for UID 1000 ● systemd-pcrlogin@945.service loaded failed failed TPM NvPCR Measurement of User Record for UID 945 ● systemd-pcrproduct.service loaded failed failed TPM NvPCR Product ID Measurement ● systemd-tpm2-setup-early.service loaded failed failed Early TPM SRK Setup Sep 22 20:01:07 loq systemd-tpm2-setup[370]: Failed to initialize NvPCR index: No such file or directory Sep 22 20:01:07 loq systemd-tpm2-setup[370]: Failed to initialize NvPCR index: No such file or directory Sep 22 20:01:07 loq systemd-tpm2-setup[370]: Failed to initialize NvPCR index: No such file or directory Sep 22 20:01:07 loq systemd-tpm2-setup[370]: Failed to initialize NvPCR index: No such file or directory Sep 22 20:01:07 loq systemd-tpm2-setup[370]: 4 NvPCRs failed to initialize, proceeding anyway. Sep 22 20:01:07 loq systemd[1]: TPM PCR NvPCR Initialization Separator skipped, unmet condition check ConditionPathExists=/etc/initrd-release Sep 22 20:01:07 loq systemd[1]: Starting TPM NvPCR Product ID Measurement... Sep 22 20:01:07 loq systemd-pcrextend[404]: Could not extend NvPCR: No such file or directory Sep 22 20:01:07 loq systemd[1]: Failed to start TPM NvPCR Product ID Measurement. Sep 22 20:01:09 loq systemd[1]: TPM PCR NvPCR Initialization Separator skipped, unmet condition check ConditionPathExists=/etc/initrd-release Sep 22 20:01:09 loq systemd[1]: Starting TPM NvPCR Product ID Measurement... Sep 22 20:01:09 loq systemd-pcrextend[661]: Could not extend NvPCR: No such file or directory Sep 22 20:01:09 loq systemd[1]: Failed to start TPM NvPCR Product ID Measurement. Sep 22 20:01:09 loq systemd[1]: TPM PCR NvPCR Initialization Separator skipped, unmet condition check ConditionPathExists=/etc/initrd-release Sep 22 20:01:09 loq systemd[1]: Starting TPM NvPCR Product ID Measurement... Sep 22 20:01:10 loq systemd-pcrextend[673]: Could not extend NvPCR: No such file or directory Sep 22 20:01:10 loq systemd[1]: Failed to start TPM NvPCR Product ID Measurement. Sep 22 20:01:10 loq systemd[1]: Starting TPM NvPCR Measurement of User Record for UID 945... Sep 22 20:01:10 loq systemd-pcrextend[870]: Could not extend NvPCR: No such file or directory Sep 22 20:01:10 loq systemd[1]: Failed to start TPM NvPCR Measurement of User Record for UID 945. Sep 22 20:01:20 loq systemd[1]: Starting TPM NvPCR Measurement of User Record for UID 1000... Sep 22 20:01:20 loq systemd-pcrextend[1176]: Could not extend NvPCR: No such file or directory Sep 22 20:01:20 loq systemd[1]: Failed to start TPM NvPCR Measurement of User Record for UID 1000. ```

So you might need to wait for the KDE Linux build script to be updated.

You can safely ignore the message, anyway. Just a portion of the boot process not being measured.

pg-tips · October 7, 2026, 10:46am

Failing updates is a separate issue that we are looking at.

We’ve just made a change to the update server config which hopefully will improve the situation, so you could retry the update in a little while.

pg-tips · October 7, 2026, 11:03am

Thanks for the link!

Tracking it at https://invent.kde.org/kde-linux/kde-linux/-/work_items/809

sib · October 10, 2026, 2:45pm

Worse than this message at boot, it appears when I put my KDE Linux VM (qemu/virt-manager) to sleep, and then it can’t be awakened. This may not occur with physical KDE Linux, but still indicates a problem. I’m not sure whether to report this as a bug.

jinliu · October 10, 2026, 3:06pm

Does it work for other distributions (e.g., Fedora, OpenSuse) running in qemu? If not, then more likely a qemu problem.

sib · October 10, 2026, 4:08pm

Yes, thank you. Sleep fails for a Fedora VM too. I only experienced this because I was trying to use a VM as a daily driver. I may need to do a physical install if I want to pursue that level of KDE Linux testing. Happily, putting the host to sleep doesn’t cause this problem.

chineduokafor · October 11, 2026, 1:34am

This boot message typically comes from systemd-tpm2-setup-early.service in early userspace when systemd attempts to initialize the TPM 2.0 Storage Root Key (SRK).

Check the service logs with journalctl -b -u systemd-tpm2-setup-early.service to see the specific error reported by the TPM stack, and verify whether TPM 2.0 is detected and accessible with systemd-cryptenroll --tpm2-device=list.

If you don’t use TPM-backed full disk encryption or PCR enrollment, this failure doesn’t affect system operation. You can silence the boot error by masking the unit: sudo systemctl mask systemd-tpm2-setup-early.service.

If you rely on TPM-based unlocking, the message usually points to an uninitialized, invalid, or corrupt SRK handle. Clearing the TPM in your UEFI/BIOS setup and re-enrolling your LUKS keys should recreate a clean SRK.