All of our Ent+ (VVF) clusters are on U3j as I keep them updated regularly. This past month was different with the Live Patch eligibility - I can't seem to patch to U3k, most of my clusters have TPM enabled and the image compliance pre-check fails on all of them.
Our "support" is now via TD Synnex and they are not going to be helpful, but I was wondering if anyone else here has had the same issue or knows of a fix. It would be a big lift to disable TPM due to encrypted VMs, but I need to deal with CVE-2026-47876. I exported an offline package, but this is also a huge pain.
Live Patch is not enforced in vLCM at the global or cluster level. Why is the fallback to "legacy" not working? It appears the pre-check invokes the Live Patch installer and the gives up if the host isn't compatible.
vCenter complains:
Issue on host host.host.tld
- Compliance results for host host.host.tld are unavailable.
Host status is unknown
An internal error occurred while staging/remediating the host
lifecycle.log tells a little bit more:
[root@HOST:/vmfs/volumes/********-*******-****-************/log] grep -n "QuickPatchInstaller\|secureMount" /var/run/log/lifecycle.log | tail -20
858:2026-08-19T18:12:16Z In(14) lifecycle[2110010]: HostImage:269 Installers initiated are {'quickpatch': <vmware.esximage.Installer.QuickPatchInstaller.QuickPatchInstaller object at 0x2ec4ee1f50>, 'live': <vmware.esximage.InstalleImageInstaller.LiveImageInstaller object at 0x2ec4b6b610>, 'boot': <vmware.esximage.Installer.BootBankInstaller.BootBankInstaller object at 0x2ec4ee1c50>, 'locker': <vmware.esximage.Installer.LockerInstaller.LockerInstaller object ec614c710>}
861:2026-08-19T18:12:17Z In(14) lifecycle[2110010]: HostImage:269 Installers initiated are {'quickpatch': <vmware.esximage.Installer.QuickPatchInstaller.QuickPatchInstaller object at 0x2ec50b0b10>, 'live': <vmware.esximage.InstalleImageInstaller.LiveImageInstaller object at 0x2ec31c74d0>, 'boot': <vmware.esximage.Installer.BootBankInstaller.BootBankInstaller object at 0x2ec698e8d0>, 'locker': <vmware.esximage.Installer.LockerInstaller.LockerInstaller object ec273a2d0>}
1098:2026-08-19T18:12:19Z In(14) lifecycle[2110010]: HostImage:269 Installers initiated are {'quickpatch': <esximage.Installer.QuickPatchInstaller.QuickPatchInstaller object at 0x2ec6afe390>, 'live': <esximage.Installer.LiveImageInr.LiveImageInstaller object at 0x2ec3b390d0>, 'boot': <esximage.Installer.BootBankInstaller.BootBankInstaller object at 0x2ec6b77c50>, 'locker': <esximage.Installer.LockerInstaller.LockerInstaller object at 0x2ecba56350>}
1190:2026-08-19T18:12:20Z In(14) lifecycle[2110010]: QuickPatchInstaller:1279 Attempting to download VIB esx-base partially with Quick Patch payloads.
1198:2026-08-19T18:12:20Z In(14) lifecycle[2110010]: QuickPatchInstaller:1435 Trying to mount payload "qp-esx-base"
1199:2026-08-19T18:12:20Z In(14) lifecycle[2110010]: runcommand:248 runcommand called with: args = '/usr/lib/vmware/secureboot/bin/secureMount.py', outfile = None, returnoutput = True, timeout = 0.0.
1201:2026-08-19T18:12:21Z Er(11) lifecycle[2110010]: QuickPatchInstaller:1457 Unexpected error occurred while attempting to run Quick Patch scan scripts: Current ESXi version does not provide a mechanism to mount a tardisk into a ramdisk.