Practical disadvantages of GCM mode encryption It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to recommend it. This question is a call to those experts to clearly define those concerns.

Are there any properties of GCM mode encryption that make it less secure in practical operations than CBC + HMAC using two separate keys?

Answers could focus for instance on properties of the algorithm that make it more vulnerable to side channel attacks than other algorithms.
In comparison to CBC mode and HMAC, GCM mode is quite a commonly better alternative. But, I'll go to detail where it necessarily is not. Just like Richie Frame, I also do not agree that CBC + HMAC is always the best comparison target. I've added a few other details. Hope you find them useful.

Against CBC and HMAC

I'll discuss downsides first.

The authentication part of GCM (GHASH) is weaker than HMAC, GHASH provides a maximum 128-bit authentication tag, whereas HMAC allows lot longer tags (HMAC-SHA-256 would allow 256-bit authentication tag). In addition, forgery of GHASH tags in some cases is easier than HMAC:


  As with any tag-based authentication mechanism, if the adversary chooses a $t$-bit tag at random, it is expected to be correct for given data with probability $1/2^t$. With GCM, however, an adversary can choose tags that increase this probability, proportional to the total length of the ciphertext and AAD. (Borrowed from NIST SP 800-38D.)


Implementations using GCM mode often use short IV (96-bits), in fact, e.g. NIST SP 800-38D recommends using the 96-bit IVs. (Longer IVs are defined but they'll require the extra invocation of GHASH function.)
The 96-bit IVs (GCM) can be too short uses where 128-bit IV (CBC) would be sufficient. Consider e.g. collision probability of random IVs.

Benefits of GCM: Properly implemented GCM is almost always faster, and it is easier to use GCM than operate AES + HMAC combination correctly. CBC mode requires padding input to the block size, thus GCM mode produces smaller output if the input is not multiple of the block size.

Against CTR + HMAC

Because the AES parallelization benefits are available via CTR mode as well, CTR + HMAC is fairly similar to GCM and can perform pretty well. It can be better, in case authentication tag requirements exceed what GCM can provide.

Against CCM

The CCM mode is largely similar to GCM mode. It's the largest benefit is that implementation requires less code (SW) or gates (HW), but CCM implementations generally are slower than GCM.

Overall, some IEEE 802 standards tend to pick CCM over GCM due to the HW implementation gate count.

SIV-AES and AES-KW

It is possible to wrap other keys using AES-GCM (key wrapping).

For authenticated encryption where the target is key wrapping (encryption of key with another key), SIV-AES and AES-KW algorithms are commonly better than AES-GCM. Better in the sense that they can be used without reliance on random
number generation (or a deterministic IV generator) and that their output can be smaller because there is no need IV in addition to encrypted output and authentication tag. (These are commonly considered to be benefits of deterministic authenticated encryption.)

Key, IV pair reuse

I've already mentioned IV, key pair reuse.

GCM mode does not resist the reuse of Key IV combination. To prevent this, some parties like NIST put more requirements on the proper use of GCM mode than the other modes. This is a good idea from the security point of view, but it may reduce the allowed uses of the mode.

Generally, GCM is most convenient for uses where new keys are agreed or transported as a part of the protocol (TLS or IPsec). If there is use where a persistently stored key is needed, then it can be cumbersome to ensure IV uniqueness.

NIST is aware of this pitfall. NIST's CMVP (Cryptographic Module Validation Program aka FIPS 140-2 validation program) has a requirement for the careful use of GCM (FIPS 140-2 IG A.5). FIPS-approved implementations of GCM mode need to be very careful in their use of keys because, in GCM mode reuse of key, IV pair is not allowed to happen.

CBC-ESSIV

AES-CBC mode can be used for disk encryption (especially with ESSIV, see Wikipedia disk-encryption theory). The fact that GCM often uses small IV length and is not IV collision-resistant makes it hard to apply for contexts where it is needed to encrypt a large number of blocks and encryption does not happen in-order (deterministic IV increasing would be ok). For this reason, AES-GCM is not that much used for encryption of stored data, but rather data at transit.

Summary

GCM is a very good mode of operation, and it often is more convenient than legacy algorithms combinations like CBC + HMAC. However, it is not a universal solution (none of the modes is), but rather it is most convenient only for a large number of data at transit.