HP ThinPro TPM Flaw: Major LUKS Encryption Risk

**Executive Summary:** The report details a boot‑chain weakness in HP ThinPro (tested on t530/t540) that can allow an attacker with physical access and storage manipulation to modify the initramfs, copy out a recovered 32‑byte TPM‑sealed LUKS2 key to an unencrypted partition, and thereby decrypt the protected volume; HP was notified (Feb 22, 2026) and a fix was reported to be in QA but no CVE or public patch was available at disclosure.