systemd-tpm2-setup-early.service and systemd-tpm2-setup.service fail after upgrading to v259
Author: catch-404Created Dec 20, 2025Updated Sep 15, 2026
Labelsbug 🐛regression ⚠️tpm2
systemd version the issue has been seen with
259-1
Used distribution
Arch
Linux kernel version used
6.18.1-arch1-2
CPU architectures issue was seen on
x86_64
Component
systemd
Expected behaviour you didn't see
systemd-tpm2-setup-early.service and systemd-tpm2-setup.service not failing after boot.
Unexpected behaviour you saw
systemd-tpm2-setup-early.service and systemd-tpm2-setup.service failing after boot.
both /var/lib/systemd/tpm2-srk-public-key.pem and /var/lib/systemd/tpm2-srk-public-key.tpm2b_public still exist on the booted system even though the two services fail.
TPM-based LUKS unlock (with TPM PIN) at boot continues to work correctly despite these service failures.
Steps to reproduce the problem
Update to v259, reboot. The services were working correctly on systemd 258 and previous versions. Reverting to a pre-upgrade snapshot fixes the issue.
Configuration:
- UKI with PCR signature signing via /etc/kernel/uki.conf for PCR policy (not raw values)
- Secure Boot signing through sbctl
- systemd-boot
Additional program output to the terminal or log subsystem illustrating the issue
$ journalctl -eu systemd-tpm2-setup-early.service
déc 20 09:17:30 archWKS systemd-tpm2-setup[783]: SRK already stored in the TPM.
déc 20 09:17:30 archWKS systemd-tpm2-setup[783]: SRK fingerprint is f21ccb6f162b47ca205796bd0e2db19fd464fd06c2affca9a71bc49a876b3f76.
déc 20 09:17:30 archWKS systemd-tpm2-setup[783]: SRK public key saved to '/run/systemd/tpm2-srk-public-key.pem' in PEM format.
déc 20 09:17:30 archWKS systemd-tpm2-setup[783]: SRK public key saved to '/run/systemd/tpm2-srk-public-key.tpm2b_public' in TPM2B_PUBLIC format.
déc 20 09:17:30 archWKS systemd-tpm2-setup[783]: Failed to unseal secret using TPM2: No such device or address
déc 20 09:17:30 archWKS systemd-tpm2-setup[783]: Failed to acquire anchor secret: No such device or address
déc 20 09:17:30 archWKS systemd[1]: systemd-tpm2-setup-early.service: Main process exited, code=exited, status=1/FAILURE
déc 20 09:17:30 archWKS systemd[1]: systemd-tpm2-setup-early.service: Failed with result 'exit-code'.
déc 20 09:17:30 archWKS systemd[1]: Failed to start Early TPM SRK Setup.
$ journalctl -eu systemd-tpm2-setup.service
déc 20 09:17:30 archWKS systemd[1]: Starting TPM SRK Setup...
déc 20 09:17:30 archWKS systemd-tpm2-setup[975]: SRK already stored in the TPM.
déc 20 09:17:30 archWKS systemd-tpm2-setup[975]: SRK fingerprint is f21ccb6f162b47ca205796bd0e2db19fd464fd06c2affca9a71bc49a876b3f76.
déc 20 09:17:30 archWKS systemd-tpm2-setup[975]: SRK saved in '/var/lib/systemd/tpm2-srk-public-key.pem' matches SRK in TPM2.
déc 20 09:17:30 archWKS systemd-tpm2-setup[975]: Failed to unseal secret using TPM2: No such device or address
déc 20 09:17:30 archWKS systemd-tpm2-setup[975]: Failed to acquire anchor secret: No such device or address
déc 20 09:17:30 archWKS systemd[1]: systemd-tpm2-setup.service: Main process exited, code=exited, status=1/FAILURE
déc 20 09:17:30 archWKS systemd[1]: systemd-tpm2-setup.service: Failed with result 'exit-code'.
déc 20 09:17:30 archWKS systemd[1]: Failed to start TPM SRK Setup.Source: systemd/systemd