A VM escape hits every Proxmox homelab: patch and reboot tonight. On the bench, Liquid AI's LFM2.5-24B-A2B — a 24B MoE that fits a 16GB GPU and is tuned for tool calling. Plus: Immich, a 128GB AMD box, and a ten-port mini PC.
Proxmox advisory PSA-2026-00068-1 ("PwnEscape", CVE-2026-99999) discloses a guest-to-host KVM escape in the virtio network stack: bad checksum metadata lets a guest read host memory and write host kernel memory. Fixed in proxmox-kernel 7.0.14-24-pve.
The catch: installing the package does nothing until the host reboots onto the new kernel. Patch path: apt update && apt full-upgrade, reboot, confirm uname -r shows 7.0.14-24-pve or newer. (Early-October builds 22/23 carry an earlier variant — take the newest.) Proxmox VE 8 gets no fix; upgrading to VE 9 is the way out. No confirmed exploitation yet.
For your rack: if anything runs guests on your host, this is tonight's job. An unbooted patch is no patch.
Liquid AI released LFM2.5-24B-A2B on October 13. Its numbers (vendor) lead on agent work: AutomationBench 27.69 vs Qwen3.6-35B-A3B's 8.72; ToolSandbox 80.71 vs 75.02. It trails on knowledge and coding (GPQA Diamond 74.42 vs 83.69; SWE-Bench Verified 51.00 vs 66.20). No independent replication yet — treat as claim, not result. Community testing (community): 4–5-bit files held BF16-level tool-call accuracy.
Fits at 32k context, from file size plus runtime overhead (our estimate).
Runs in llama.cpp, MLX, vLLM, LM Studio; official GGUF and MLX builds on Hugging Face. Use a current llama.cpp build (b11606+) and pass --jinja for tool calls. Vendor samplers: temperature 0.1, top_k 50, repetition penalty 1.05. Difficulty: light setup.
Give me exact install and run commands for Liquid AI's LFM2.5-24B-A2B; ask my GPU or Mac model and memory first. Use GGUF: Q5_K_M for 24GB, IQ4_XS for 16GB, Q8_0 for 48GB or a 64GB Mac, BF16 for 96GB+. llama.cpp b11606+, --jinja on, temperature 0.1, top_k 50, repetition penalty 1.05. Flag guesses instead of inventing steps.
Ten Ethernet ports, none slower than 2.5GbE. ServeTheHome's review of Qotom's Q51551UT: six 2.5GbE, two 10GbE RJ45, two 10GbE SFP+; tested at 96GB DDR5. Caveats: the RJ45 ports use Intel's X540-AT2 — no 2.5/5GbE fallback, so a 2.5GbE switch port gets a 1GbE link; ports share PCIe bandwidth; the front RJ45 is serial console. No price listed. Dense enough to retire a small switch, if your links match its controllers.
Immich v3.3.5 is a security update — install it. It carries a fix tied to that day's certificate authority compromise (eMudhra) plus Node.js security patches. The project recommends updating promptly, while saying instances are not in immediate danger. The rest is dependency updates.
A 128GB AMD box with an OCuLink port. ServeTheHome's GMKtec EVO-X3 review : a Ryzen AI Max+ 395 mini PC with 128GB soldered LPDDR5X-8000, two Gen4 M.2 slots, and a rare OCuLink port. In ServeTheHome's MLPerf testing (independent), Phi-4 14B reasoning averaged 24.7 tok/s. Catch: one 2.5GbE port, where rivals now ship 10GbE.
How we source: facts come from primary sources opened for this issue. Benchmarks are labeled (vendor), (independent), or (community); fit figures marked "our estimate" are computed, not measured. This is not buying advice.
Corrections: None today.
The Homelab Herald is independent — no vendor pays for coverage, and no affiliate links run in issues.
Archive · Can I run it? · RSS