- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,219
We explain why a large-scale move to another language didn't go according to plan.
The new Ubuntu release hasn't even been released yet, and already a curious cybersecurity story has unfolded around it. The developers decided to test one of the system's key components beforehand—and the results were quite unexpected.
Canonical commissioned an independent audit of Rust Coreutils , a set of core utilities rewritten using the Rust language. The audit was conducted by the Zellic team. The results revealed 113 issues, including dozens of vulnerabilities with CVE identifiers. According to the report's author, Ravi Kant Sharma, a significant portion of the identified bugs have already been fixed.
The project involves replacing the classic GNU Coreutils—a set of tools like cp, mv, and rm—with a safer implementation written in Rust . This transition was intended to reduce the risk of common memory management errors. However, an audit revealed that the new implementation has not yet eliminated all vulnerabilities.
Ubuntu 26.04 LTS uses Rust Coreutils version 0.8, which includes most of the fixes. However, some key utilities still rely on GNU Coreutils. This is due to unresolved TOCTOU-class issues related to the discrepancy between state checking and subsequent data usage. Such vulnerabilities can open the door to attacks when working with the file system.
Ubuntu makes no secret that the current release is just an interim step. The developers expect to fully replace GNU Coreutils by version 26.10. By then, any remaining issues should be resolved, and the new implementation should become the foundation of the system.
Zellic's detailed report hasn't yet been published in full, but it's already clear that the transition to Rust has proven more challenging than expected. However, the strategy remains the same: gradually replace critical components with more secure alternatives without compromising system stability.
The new Ubuntu release hasn't even been released yet, and already a curious cybersecurity story has unfolded around it. The developers decided to test one of the system's key components beforehand—and the results were quite unexpected.
Canonical commissioned an independent audit of Rust Coreutils , a set of core utilities rewritten using the Rust language. The audit was conducted by the Zellic team. The results revealed 113 issues, including dozens of vulnerabilities with CVE identifiers. According to the report's author, Ravi Kant Sharma, a significant portion of the identified bugs have already been fixed.
The project involves replacing the classic GNU Coreutils—a set of tools like cp, mv, and rm—with a safer implementation written in Rust . This transition was intended to reduce the risk of common memory management errors. However, an audit revealed that the new implementation has not yet eliminated all vulnerabilities.
Ubuntu 26.04 LTS uses Rust Coreutils version 0.8, which includes most of the fixes. However, some key utilities still rely on GNU Coreutils. This is due to unresolved TOCTOU-class issues related to the discrepancy between state checking and subsequent data usage. Such vulnerabilities can open the door to attacks when working with the file system.
Ubuntu makes no secret that the current release is just an interim step. The developers expect to fully replace GNU Coreutils by version 26.10. By then, any remaining issues should be resolved, and the new implementation should become the foundation of the system.
Zellic's detailed report hasn't yet been published in full, but it's already clear that the transition to Rust has proven more challenging than expected. However, the strategy remains the same: gradually replace critical components with more secure alternatives without compromising system stability.
