Ai Use In The Linux Kernel, Microsoft Defender On Linux & Other October Highlights

Welcome back to Self-Hosted Tech! If you’re anything like me, you probably spent a good chunk of October swapping out hard drives, tweaking Docker compose files, and keeping an eye on the ever-evolving landscape of open-source software. October was an incredibly busy month for the homelab, self-hosting, and local AI communities. We saw some massive paradigm shifts, a few unexpected cross-platform releases, and hardware news that makes us want to re-evaluate our rack space.

Today, we’re going to break down the biggest October highlights. We’ll dive deep into the experimental AI integrations making their way into the Linux kernel, discuss why Microsoft Defender is suddenly a must-have tool for Linux servers, and round up the rest of the month’s essential news. Finally, we’ll get our hands dirty with a practical walkthrough on installing and testing Microsoft Defender on a Linux box.

Grab your favorite terminal emulator, and let’s get into it.

AI Use in the Linux Kernel: The End of the Dumb Scheduler?

For decades, the Linux kernel has relied on deterministic, rule-based algorithms to manage system resources. The Completely Fair Scheduler (CFS), which has been the default for years, does a fantastic job of distributing CPU time fairly among processes. But as our homelab hardware becomes more complex—mixing high-core-count Xeons, ARM-based Raspberry Pis, and heterogeneous architectures like Intel’s P-core/E-core setups—traditional schedulers are starting to show their limits.

In October, discussions and experimental patches around bringing Machine Learning (ML) and Artificial Intelligence (AI) directly into the kernel gained serious traction.

What Does AI in the Kernel Actually Look Like?

We aren’t talking about running a local LLM inside the kernel space to chat with your CPU. Instead, this is about lightweight, predictive machine learning models designed to optimize hardware utilization.

One of the most exciting areas is the sched_ext (extensible scheduler) framework. This allows developers to write custom CPU schedulers using BPF (Berkeley Packet Filter) that can be loaded and unloaded dynamically. Some of these experimental schedulers are now utilizing simple ML models to predict process behavior.

For example, instead of the kernel simply reacting to a process asking for CPU time, an ML-assisted scheduler can look at historical data and predict:

  • When a process is likely to wake up: Allowing the CPU to stay in a deeper sleep state (C-states) longer, saving power on always-on homelab servers.
  • How long a process will run: Helping the scheduler decide whether to move a task to a faster P-core or a more efficient E-core in Intel architectures.
  • Memory access patterns: Pre-fetching data into the CPU cache before the process even requests it, drastically reducing latency.

Why This Matters for Your Homelab

If you’re running older enterprise hardware (like decommissioned Dell PowerEdges or HP ProLiants), an AI-optimized kernel could squeeze extra years of life out of your silicon. Better scheduling means lower latency for your self-hosted services like Nextcloud, Plex, or Home Assistant. For those of us running local AI models on mixed hardware (e.g., CPU inference alongside GPU offloading), an intelligent kernel scheduler could dynamically allocate resources based on the inference workload, ensuring your UI doesn’t freeze while a model is generating text.

While this tech is still highly experimental and likely a year or two away from mainstream stable kernels, it’s a clear signal that the line between “AI hardware” and “general compute” is blurring.

Microsoft Defender on Linux: Embrace and Extend… Security?

Let’s address the elephant in the server room: Microsoft has been doing a lot of Linux work lately, and October solidified Microsoft Defender for Endpoint (MDE) as a genuinely robust security solution for Linux servers.

If you’re running a pure Linux homelab, you might be thinking, “Do I really need antivirus on Linux? Isn’t Linux immune to malware?”

The short answer is no, Linux isn’t immune. While Linux desktops are rarely targeted by traditional malware, Linux servers are prime targets for cryptominers, ransomware, and botnets. Furthermore, if you are running a Samba share, a Nextcloud instance, or an email server on Linux, your Linux box can act as a carrier for Windows malware. A Windows machine might upload an infected file to your self-hosted Nextcloud, which then gets synced down to your laptop.

How Defender Works on Linux

Microsoft Defender on Linux isn’t just a port of the Windows version; it’s built from the ground up for Unix-like environments. It hooks into the kernel’s fanotify subsystem to monitor file system events in real-time.

For homelabbers, this is huge. If you have a mixed environment—say, a Proxmox host running Linux containers for your infrastructure but Windows VMs for gaming or specific software—Defender can act as a central scanning engine. It catches Windows executables, scripts, and Linux ELF binaries as they are written to disk, protecting your network from cross-platform threats.

Other October Highlights in the Homelab World

October wasn’t just about kernel AI and Microsoft. Here are a few other highlights you should have on your radar:

  • Proxmox VE 8.1 Released: The holy grail of homelab hypervisors got a major update. Proxmox 8.1 brings improved ZFS support (including native encryption management via the GUI), better cluster handling, and updated Linux kernels (6.5). If you’re running older hardware, the new kernel brings better driver support for outdated network cards and storage controllers.
  • Raspberry Pi 5 Cooling Solutions Hit the Market: With the Pi 5 running significantly hotter than its predecessor, October saw a flood of active cooler designs. If you’re self-hosting on a Pi, investing in the official active cooler is no longer optional if you want to maintain peak clock speeds during heavy local AI tasks.
  • Local AI Hardware Drops: We saw price cuts on consumer GPUs that make local LLM hosting much more accessible. 16GB and 24GB VRAM cards (like the RTX 4080 and 3090) are dropping in the used market, making it the perfect time to build a dedicated local AI inference server.

Practical Walkthrough: Installing Microsoft Defender on Ubuntu

Let’s get practical. If you want to test out Microsoft Defender on your Linux servers, you can do so easily. While the full Endpoint console requires a Microsoft 365 subscription, you can install the engine and run manual scans to see how it integrates with your system.

For this walkthrough, we’ll be using Ubuntu 22.04, a staple in many homelabs.

Step 1: Prepare Your System

First, ensure your system is up to date and has the necessary tools to add new repositories.

1
2

sudo apt update && sudo apt upgrade -y
sudo apt install curl gnupg -y

Step 2: Add the Microsoft Repository

Microsoft hosts the Defender packages in its own Ubuntu repository. We need to download the GPG key, convert it, and add the repo to our sources list.

1
2
3
4
5
6

# Download the Microsoft GPG key
curl -s https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg
sudo mv microsoft.gpg /etc/apt/trusted.gpg.d/microsoft.gpg

# Add the repository
sudo sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/ubuntu/22.04/prod jammy main" > /etc/apt/sources.list.d/microsoft.list'

Step 3: Install the Package

Now that the repository is added, update your package list and install the Defender package. The package name is mdatp (Microsoft Defender Advanced Threat Protection).

1
2

sudo apt update
sudo apt install mdatp -y

Step 4: Verify the Installation

Once installed, you can check the health of the Defender agent using the command-line tool.

1

mdatp health

You should see an output showing the agent version, engine version, and the healthy: true status. By default, it might be in passive mode depending on your licensing, but the engine is active and ready to scan.

Step 5: Test with the EICAR File

To ensure Defender is actually catching malware, we can use the standard EICAR test file. This is a harmless text file that all antivirus programs recognize as a test virus.

Let’s create the file and see what happens:

1

curl -s https://www.eicar.org/download/eicar.com.txt -o eicar_test.txt

If Defender is running properly with real-time protection enabled, you should immediately see an alert in your terminal indicating that a threat was detected and quarantined. If real-time protection isn’t on by default, you can trigger a manual scan:

1

mdatp scan custom --path /path/to/eicar_test.txt

You can then check the threat history:

1

mdatp threat list

From here, you can clean up the threat using mdatp threat remove --id [threat-id]. It’s a remarkably smooth process, and seeing a Microsoft product seamlessly quarantine a file on a Linux terminal via fanotify is a testament to how far cross-platform enterprise software has come.

Summary and Call to Action

October was a landmark month for self-hosters. The introduction of AI concepts into the Linux kernel hints at a future where our hardware is managed by predictive, intelligent algorithms, squeezing every ounce of performance out of our silicon. Meanwhile, the maturation of Microsoft Defender on Linux proves that the old platform wars are truly over, giving us powerful, cross-platform security tools to protect our self-hosted data.

Between Proxmox updates, cooling our hot new Raspberry Pis, and snagging deals on GPUs for local AI, there has never been a better time to be a homelabber.

What do you think about AI making its way into the Linux kernel? Are you going to give Microsoft Defender a spin on your Linux servers, or do you prefer open-source alternatives like ClamAV?

Let us know in the comments below! If you found this article helpful, make sure to subscribe to the Self-Hosted Tech YouTube channel and bookmark the blog for more practical guides, hardware reviews, and deep dives into the world of self-hosting. Keep those servers humming, and we’ll see you in the next one!