Using TPM 2.0 on Ubuntu 26.04 to unlock LUKS encrypted volumes during boot

PCR registers:
0 - Core system firmware executable code
1 - Core system firmware data/host platform configuration
4 - Boot loader and additional drivers
5 - GPT/Partition table
7 - SecureBoot state
8 - GRUB - Commands and kernel command line
9 - GRUB - All files read (including kernel image)

Check if SecureBoot is enabled:

mokutil --sb-state

Detecting the TPM 2.0 device:

sudo systemd-cryptenroll --tpm2-device=list

Enrolling the hardware token, binding to PCRs 0, 1, 4, 5, 7, 8, 9:

sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+1+4+5+7+8+9 /dev/nvme0n1p3

verify:

sudo systemd-cryptenroll /dev/nvme0n1p3

show LUKS keyslots:

sudo cryptsetup luksDump /dev/nvme0n1p3

verify used PCRs:

sudo cryptsetup luksDump --dump-json-metadata /dev/nvme0n1p3 | grep tpm2-pcrs -A 8

Append /etc/crypttab with "tpm2-device=auto"

dm_crypt-0 UUID=5138c9cd-ff6c-4a4b-baba-5707e8517de6 none luks,discard,tpm2-device=auto

Install tmp2-tss:

sudo apt install tpm2-tools tpm2-tss

Upgrade GRUB config:

sudo update-grub

Upgrade initramfs:

sudo update-initramfs -u -k all

Verify initramfs:

sudo lsinitramfs /boot/initrd.img-$(uname -r) | grep -Ei 'tpm2|tss|cryptsetup'

read the SHA-256 PCR bank:

sudo tpm2_pcrread sha256:0,1,4,5,7,8,9

check TPM2 event log:

tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements

Kernel update
Kernel update changes 1,4,8,9 PCRs.
Need to perform once agin:

sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+1+4+5+7+8+9 /dev/nvme0n1p3

Disclaimer:
For better security use UKI instead of GRUB in your Ubuntu setup.