Good morning — it's Thursday, November 5. CVE-2026-98432 is a 9.8 in the Linux kernel, and Ubuntu's fix is still not out — patch, reboot, or mitigate tonight. From the bench: Ripple-65B Preview, a dense 65B coder. Drops: the Kimi K3.1 Pro weights, a self-hosted agent workspace, Armbian 26.11 testing. Forward this to a fellow home labber.
Share this issue: X WhatsApp Reddit Facebook LinkedIn Text Email
CVE-2026-98432 sits in the code accepting every new IPv4 TCP connection: the kernel can hand a new connection options that another CPU has already freed. Ubuntu's tracker says it can lead to remote code execution, and it is in every kernel from 4.4 onward. The kernel team and Red Hat both rate it 9.8 out of 10.
Elsewhere, the map is patched: Debian and Red Hat shipped fixes (Red Hat on November 1), Proxmox's 7.0 kernel carries the fix — but a patch only counts after a reboot, and plenty of lab boxes run the fix in /boot, not in memory. Ubuntu is the hole: its tracker, updated yesterday, still lists every supported release as vulnerable, fixes marked work in progress.
Why tonight: Anthropic has described (attributed; not independently verified) a working remote root exploit aimed at servers running a multipath TCP listener — and since Go 1.24, Go programs ask for multipath TCP by default, so proxies and agents may listen that way unchosen. A lost race does not crash the server; attackers can keep trying.
Tonight, then: if your distro has the fix, install it and reboot. On Ubuntu, use Canonical's own mitigation — an nftables rule that drops incoming IPv4 TCP packets carrying IP options. Ordinary connections are unaffected; containers with their own networking need the rule separately, and Canonical is clear it reduces risk rather than removing it.
Ripple-65B Preview, released yesterday by Ricursive Intelligence, is a dense model trained from scratch on 12 trillion tokens. Against the local leader, Qwen3.8-27B, Ripple takes two of three. Higher is better throughout:
Terminal-Bench 2.1, Terminus harness: Ripple-65B Preview 80.5, Qwen3.8-27B 73.0 — Ripple ahead by 7.5
DeepSWE 1.1: Ripple-65B Preview 44.3, Qwen3.8-27B 42.2 — Ripple ahead by 2.1
SWE-bench Pro: Ripple-65B Preview 61.42, Qwen3.8-27B 61.7 — Qwen ahead by 0.3
Every score is from that model's own card (vendor); the harnesses differ, no independent run exists yet, and Ricursive's own card and launch graphic disagree on some rival figures.
Setup notes: the full-precision checkpoint is datacenter-class; the home route is its NVFP4 checkpoint, which the card says fits DGX Spark-class hardware. Difficulty: fiddly (preview release).
The 2.8-trillion-parameter download is real. Moonshot has published the Kimi K3.1 Pro weights: 104 billion active parameters, a one-million-token context, and a headline 65.7 on Terminal-Bench 4.0 (vendor) — run, per its footnote, in the Claude Code harness. Nobody serves this from a home rack; the news is the release itself, under a custom license worth reading first.
GitHub find: Open Duet gives your agents a desk and a leash. Open Duet is a self-hosted workspace for named AI coworkers — each with instructions, memory, routines, and its own isolated computer — and nothing acts without your approval. It can drive local engines, too; the repo is honest that the server is experimental and single-owner. 6,780 stars, Apache-2.0.
Armbian 26.11 wants testers, not users. The Armbian team opened testing yesterday: Debian Trixie is the new build base, the installer is rewritten, new boards include the NanoPi NEO3 Plus, and Proxmox on Trixie now works out of the box in armbian-config. Test images are up — on a spare card, the team stresses, never on a box with data you care about.
Wednesday, 9 p.m. A monitoring alert lands: the certificate on the reverse proxy in front of your self-hosted services expires at midnight. The renewal job has been failing quietly for a week — and the household's photo backup syncs through that proxy tonight.
Your call:
A. Issue a fresh certificate now, verify the new chain and expiry from outside the LAN, then put an alert on the renewal job so it cannot fail silently again
B. Close the proxy's public port until morning and renew first thing at your desk
C. Set the backup client to skip certificate verification and renew at the weekend
100 Hero Points for the right call. Your score is on the outcome page, ready to share.
We should forget about small efficiencies, say about 97% of the time: premature optimization is the root of all evil.
— Donald Knuth
Reading this because a fellow home labber forwarded it? Get your own copy every morning — subscribe free, and pass it on — that is how this grows.
How we source: facts come from primary sources opened for this issue. Benchmarks are labeled (vendor), (independent), or (community), never blended. Deal prices are checked the day they run. This is not buying advice.
Corrections: none today.
Reader-supported: paid subscriptions, labeled sponsors, and affiliate links on some gear and deal items (we may earn a commission). Coverage is never paid for — sponsors and affiliate programs don't pick stories.