Ubuntu 26.10 Completes the Switch to Rust-Based coreutils

Canonical is wrapping up the “oxidation” of Ubuntu that it began in 2025 — replacing the core system utilities with alternatives written in Rust. In the upcoming Ubuntu 26.10 “Stonking Stingray” release, the distribution will get the full set of essential command-line utilities based on the uutils project.

The transition happened in stages. Ubuntu 25.10 was the first to switch over to the Rust utilities, making the Rust version of sudo the default. In the Ubuntu 26.04 LTS release, however, three key commands — cp, mv and rm — were deliberately left in their classic GNU versions. The reason was a series of TOCTOU (time-of-check to time-of-use) vulnerabilities found in the uutils implementations. Now that these issues have been fixed upstream, Canonical is finishing the migration: the system also includes such common tools as ls, cat, chmod and du.

Why it matters

The whole point of the effort is security. Rust catches memory errors at compile time, whereas C compilers do not. At the same time, the switch brings no functional differences for the end user: uutils aims for full compatibility with the GNU versions and treats any discrepancy in behavior as a bug to be fixed. In other words, the commands work exactly the same way — there is just different, better-protected code under the hood.

Canonical's approach can hardly be called naive. Ahead of the 26.04 release, the company commissioned a security audit of uutils — and it was precisely that audit that turned up the very vulnerabilities that led to rolling back the three commands temporarily. Beyond that, Canonical is a gold sponsor of the nonprofit Trifecta Tech Foundation, directing €40,000 a year toward the development of Rust software.

What's next

The Trifecta Foundation is working on rewriting an implementation of the Network Time Protocol (NTP) in Rust. Canonical plans to make this time-synchronization client the default by the Ubuntu 27.10 release — so the distribution's “oxidation” clearly doesn't end with coreutils.

The Ubuntu 26.10 beta is expected in late September, and the stable release is slated for October 15, 2026.

Source: Lobsters