Ubuntu 26.10 Finishes Its Move to Rust Coreutils

What ships in 26.10

Ubuntu 26.10, code-named "Stonking Stingray," replaces the last three GNU coreutils commands, the basic file-and-text utilities built into every Linux system, with their Rust-based uutils equivalents, according to OMG! Ubuntu. cp, mv and rm join ls, cat, chmod and du, which had already switched over in earlier releases.

Canonical calls this goal "100% rust-coreutils," a target it set specifically for this release. Ubuntu 26.10 reaches beta later this month, with a stable release due Oct. 15, 2026.

Why three commands waited

cp, mv and rm stayed on the original GNU code in Ubuntu 26.04 LTS, released in April 2026, because their Rust rewrites carried time-of-check to time-of-use bugs. TOCTOU issues are race conditions where a file can change between the moment a program checks it and the moment it acts on it, letting a different file, often swapped in through a symlink, take its place in the gap. That is exactly the flaw a deletion tool cannot carry.

Canonical commissioned an external audit of rust-coreutils from the security firm Zellic. Canonical's Ravi Kant Sharma disclosed the results on April 22, 2026, a day before 26.04 shipped, according to Phoronix:

Zellic audit finding	Count
CVEs	70
Other issues	43
Total	113

The TOCTOU bugs in cp, mv and rm were among the issues still open when 26.04 shipped. Ubuntu 26.10 is the release where Canonical says they are closed.

The pitch was memory safety

Rust's argument over C is that its compiler catches memory bugs, such as buffer overflows, before the code ever runs. Canonical is committed enough to that argument to be a gold sponsor of the Trifecta Tech Foundation, paying it €40,000 a year to fund work on uutils, OMG! Ubuntu reported.

That is a narrower claim than "safer software." TOCTOU races are logic bugs, not memory bugs, and a compiler that catches one does not catch the other. Seventy CVEs turning up in a rewrite sold on eliminating CVEs is the detail the "100% rust-coreutils" line does not mention on its own.

What comes after 26.10

uutils aims for drop-in compatibility with the GNU tools it replaces, so command output should look the same to anyone typing at a terminal. Canonical treats any difference in output as a bug, not a feature, which is why the TOCTOU fixes took three release cycles rather than shipping alongside the rest of the rewrite.

Rust rewrites of old infrastructure are not limited to one distribution in 2026: OpenAI's own storage layer rewrite in Rust now handles 70 million requests a second, and Homebrew 7.0 dropped support for Intel-only Macs the same month Ubuntu finished its coreutils migration. Ubuntu's own next target is narrower and further out: Canonical plans to switch the distribution's NTP time-sync client, the background service that keeps a machine's clock accurate, to a Rust implementation by default in Ubuntu 27.10, extending a rewrite that already moved the sudo command to Rust in Ubuntu 25.10, a full year before coreutils caught up.