Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Ubuntu 26.10 Completes Transition to Rust-Based Coreutils
Ubuntu 26.10 “Stonking Stingray” completes Canonical’s move to Rust-based core utilities, with critical commands including cp, mv and rm now joining the uutils implementation after security and compatibility issues delayed their migration in Ubuntu 26.04 LTS.
Ubuntu 26.10 completes the transition of its default
command-line core utilities to the Rust-based uutils implementation.
Image: VMoreCloud / Ubuntu
Ubuntu is taking another major step toward increasing the use of Rust in its foundational system software. The upcoming Ubuntu 26.10 “Stonking Stingray” now uses the Rust-based uutils coreutils implementation for the full collection of default core command-line utilities.
The transition means commonly used commands such as
ls, cat, chmod,
du, cp, mv and
rm can now be provided by the Rust implementation
rather than the traditional GNU Coreutils versions.
Ubuntu had already moved most core utilities to Rust in earlier
releases, but three particularly sensitive commands —
cp, mv and rm —
remained on their GNU versions in Ubuntu 26.04 LTS while
outstanding security and compatibility concerns were addressed.
💡 Key Takeaways
- Ubuntu 26.10 now uses Rust-based uutils for the full default Coreutils collection.
- Commands including cp, mv and rm have now migrated from GNU Coreutils to their Rust implementations.
- Ubuntu 26.04 LTS retained GNU versions of these three utilities because of unresolved TOCTOU security issues.
- The outstanding issues have since been addressed upstream sufficiently for Ubuntu 26.10’s transition.
- Canonical sees memory-safe languages such as Rust as an important part of improving system security.
- Ubuntu 26.10 remains under development and is scheduled for release in October 2026.
What Changed in Ubuntu 26.10?
Ubuntu’s official 26.10 release notes describe the change as “100% Rust coreutils.” This means the remaining GNU implementations retained during Ubuntu 26.04 LTS development have now been migrated to the Rust-based uutils project.
For most users, everyday commands continue to look familiar. A user can still type familiar commands such as:
Common Linux core utilities
ls cat cp mv rm chmod du
What changes is primarily the implementation behind those commands. Instead of GNU Coreutils providing the default binaries, Ubuntu increasingly relies on the Rust-based equivalents developed by the uutils project.
What Is uutils Coreutils?
The uutils project is an open-source effort to reimplement traditional Unix command-line utilities using the Rust programming language.
Its goal is to provide utilities compatible with the commands Unix and Linux administrators already use while taking advantage of modern language features offered by Rust.
- Rust-based implementation of familiar Unix utilities.
- Cross-platform development.
- Compatibility with established Coreutils behavior.
- Open-source community development.
- Increasing adoption in Linux distributions and other projects.
Why Is Ubuntu Moving Foundational Tools to Rust?
One of Rust’s major attractions for operating-system developers is its approach to memory safety. The language is designed to prevent broad classes of programming errors such as invalid memory access and unsafe ownership patterns before software reaches production.
This does not automatically make software written in Rust free from security vulnerabilities. Logic errors, race conditions, incorrect permission handling, compatibility problems and other flaws can still occur. However, Rust can eliminate or reduce several categories of memory-management bugs traditionally associated with lower-level languages.
Technical Perspective
Moving from C implementations to Rust does not by itself guarantee that a program is secure. Security still depends on the design, implementation, testing, review and maintenance of the software. Ubuntu’s migration therefore involved both Rust’s memory-safety benefits and extensive compatibility and security testing of the new utilities.
Why Ubuntu 26.04 LTS Did Not Fully Make the Switch
Canonical had originally been working toward a broader Rust Coreutils deployment for Ubuntu 26.04 LTS. However, security analysis identified problems affecting several important utilities.
Canonical reported that cp, mv
and rm still had unresolved
time-of-check to time-of-use, or
TOCTOU, issues.
Because these commands perform operations that can modify, move or permanently remove files, Canonical chose to keep their mature GNU implementations in Ubuntu 26.04 LTS while development continued upstream.
What Is a TOCTOU Vulnerability?
A time-of-check to time-of-use issue can occur when software checks the state of a resource and then uses that resource later, leaving a small interval during which the resource may change.
In file-system operations, this can potentially create race conditions where the object checked by the program is no longer the same object being acted upon.
Simplified Example
Imagine a program first verifies that a file is safe to modify and then performs the modification a moment later. If another process changes the file or path between those two operations, the program could potentially operate on something different from what it originally checked.
Canonical Commissioned an Independent Security Audit
Before relying more heavily on uutils in an Ubuntu LTS release, Canonical commissioned an independent security assessment of the project.
The review was carried out with security research firm Zellic and took place in multiple phases. Canonical said the assessment identified 113 issues of varying severity across the reviewed utilities.
Findings were coordinated with the upstream project, and Canonical reported that the majority of those issues were subsequently addressed.
Important Context
The discovery of security issues during auditing does not necessarily mean the Rust approach failed. Auditing is specifically intended to discover weaknesses before software receives wider deployment. Ubuntu delayed the final migration of sensitive commands until the remaining issues could be addressed upstream.
Why cp, mv and rm Matter So Much
Commands such as cp, mv and
rm may appear simple, but they are among the
most fundamental utilities in a Unix-like operating system.
- cp copies files and directories.
- mv moves or renames files and directories.
- rm removes files and directories.
These utilities are used directly by system administrators, shell scripts, installation systems, maintenance jobs, development tools and countless automated workflows.
Even relatively small differences in behavior can therefore affect software far beyond the utility itself.
Compatibility Is Just as Important as Memory Safety
Replacing decades-old Unix utilities requires more than matching the most common command-line syntax. Scripts and applications may depend on specific exit codes, error messages, command options, file-handling behavior and edge cases.
GNU Coreutils has accumulated decades of development and compatibility fixes. A newer implementation such as uutils must therefore reproduce a large amount of established behavior to function as a practical replacement.
Rewriting foundational software in a memory-safe language can
reduce important classes of bugs, but compatibility, testing
and mature behavior remain equally important when replacing
tools used throughout an operating system.
— VMoreCloud Editorial
Will Ubuntu Users Notice a Difference?
Ideally, most users should notice very little difference during normal command-line use. Maintaining compatibility with familiar Unix and GNU behavior is one of the central goals of the transition.
Commands such as ls, cat,
cp and rm should continue to behave
in the way Ubuntu users and scripts expect.
The areas most likely to reveal differences are unusual command combinations, edge cases or scripts that depend on highly specific GNU behavior.
What System Administrators Should Watch
For administrators, developers and organizations testing Ubuntu 26.10, the transition is worth monitoring carefully, particularly where extensive shell automation is involved.
- Test important shell scripts against Ubuntu 26.10.
- Check workflows that rely heavily on Coreutils options.
- Test file-copying and file-removal automation.
- Verify expected return codes in critical scripts.
- Review compatibility issues documented by Ubuntu and uutils.
- Avoid assuming every GNU-specific edge case behaves identically.
Ubuntu’s Broader Investment in Rust
Coreutils is part of a wider effort by Canonical to increase Rust usage across Ubuntu’s foundational components.
Ubuntu’s development teams have described this process as gradually “oxidising” parts of the distribution — replacing or supplementing traditional components with Rust-based software where doing so provides meaningful security or maintainability benefits.
Canonical has also been investing in Rust development tooling and projects connected with memory-safe systems software. Ubuntu’s September 2026 Rust update confirms that Rust 1.97.1 is planned as the default Rust toolchain for Ubuntu 26.10.
Does This Mean GNU Coreutils Is Obsolete?
No. GNU Coreutils remains one of the most mature and widely deployed collections of Unix utilities in the Linux ecosystem.
Ubuntu’s decision represents a distribution-specific technology choice rather than an indication that GNU Coreutils is no longer useful or maintained.
Other Linux distributions can independently decide whether Rust-based alternatives fit their own security, compatibility and maintenance requirements.
Why the Change Matters for Ubuntu Server
The transition is especially notable for servers because command-line core utilities form part of countless operational workflows.
Backup scripts, configuration management systems, CI/CD pipelines, maintenance tasks, package-management scripts and administrative tools frequently invoke Coreutils commands.
Ubuntu 26.10 therefore provides a significant real-world test environment for uutils across desktop, cloud and server workloads.
Ubuntu 26.10 Is Still Under Development
It is important to distinguish the completion of the Coreutils transition from the final Ubuntu 26.10 release itself.
Ubuntu 26.10 “Stonking Stingray” is currently an in-development release and is scheduled to reach its stable release in October 2026.
Additional bugs, compatibility issues and package changes may therefore still be addressed before the final release becomes generally available.
What’s Next?
The next important phase will be broader real-world testing as Ubuntu 26.10 approaches its stable release.
Developers and administrators will be able to test complex scripts and production-like workflows against the complete Rust Coreutils implementation, providing additional feedback to both Canonical and the upstream uutils project.
The transition will also be closely watched by the wider Linux community because it provides one of the largest deployments yet of Rust replacements for traditional Unix command-line utilities.
Conclusion
Ubuntu 26.10 marks an important milestone in Canonical’s push
toward memory-safe systems software.
With cp, mv and rm
joining the rest of the Rust-based uutils suite, Ubuntu’s
default Coreutils transition is now complete for the upcoming
release.
The change does not mean Rust software is automatically immune to security problems, as the earlier audit findings themselves demonstrated. Instead, Ubuntu’s approach combines Rust’s memory-safety advantages with security reviews, upstream remediation and extensive compatibility testing.
For everyday users, the ideal result will be almost invisible: the same familiar commands and workflows, implemented using a modern memory-safe programming language underneath.
