Ubuntu 26.10, nicknamed "Stonking Stingray," is set to launch on October 15 and will be the first Linux distribution to fully replace the GNU coreutils utilities with a Rust-based alternative called uutils. This marks the completion of Canonical's "Rustification" initiative, which began in 2025. While earlier versions of Ubuntu, like 25.10, had already adopted a Rust-rewritten version of the sudo command (sudo-rs), the final transition required resolving issues with three commonly used file management utilities—cp, mv, and rm—which had to remain in their GNU versions due to security concerns. Now, with the latest release, those last three tools have been fully replaced with their Rust counterparts.
The primary goal of Canonical's shift to Rust is not to improve performance, but to enhance memory safety. Rust, the programming language used for uutils, allows developers to catch memory-related errors during the compilation phase, something traditional C programming cannot do. Since coreutils are foundational tools in any Linux system, replacing them with Rust-based versions helps prevent a wide range of potential security risks across the entire software stack.
The migration of the three file utilities was delayed due to a security audit conducted by Zellic, a security firm. The audit identified a set of TOCTOU (time-of-check to time-of-use) race conditions in uutils, which are particularly dangerous in file management tools. These vulnerabilities could allow attackers to alter files between the time a program checks their status and when it uses them, potentially bypassing security restrictions or causing data corruption. Because Ubuntu 26.04 LTS, the previous long-term support version, had stricter stability requirements, the GNU versions of these tools remained in place. With the upstream uutils project now addressing these issues, Ubuntu 26.10 can finally complete the transition.
The uutils project, originally created in 2013 by Jordi Boggiano, aims to rewrite all tools in the GNU Coreutils suite using Rust. This effort focuses on adding memory safety and concurrency protection features that Rust provides. In 2022, Sylvestre Ledru, a key developer of uutils, noted significant progress and compatibility with GNU Coreutils. Canonical has been gradually adopting these Rust-based tools, including using sudo-rs by default as a replacement for the traditional sudo command. The project is designed to be fully compatible with GNU Coreutils, ensuring that users experience no difference in functionality.
Canonical's shift to Rust is part of a broader strategy to reduce security risks in core system components. Ubuntu 27.10 is expected to include a Rust-rewritten NTP client from the Trifecta Foundation as the default time synchronization tool. Canonical also funds the Trifecta Foundation annually to support the rewriting of critical software in Rust. This initiative highlights a growing trend in the Linux ecosystem, where Rust is increasingly used for low-level system software. Ubuntu's approach could serve as a model for other distributions looking to modernize their codebase and improve system security.
Ubuntu 26.10 to Fully Replace GNU Coreutils with Rust-Based uutils Implementation
AI-rewritten from original reportingHow it works
ubunturustsecuritycoreutilsuutilscanonical



