Ubuntu 26.10 completes the distribution’s move to Rust-based core utilities, with commands that were previously held back now migrated to memory-safe versions, according to OMG Ubuntu.
Three utilities—cp, mv, and rm—remained on their GNU versions in Ubuntu 26.04 LTS due to TOCTOU (time-of-check to time-of-use) security issues that needed to be fixed in the Rust uutils versions. With those issues resolved upstream, Ubuntu 26.10 finishes the full migration, shipping a complete set of Rust core utilities including common command-line tools like ls, cat, chmod, and du.
Canonical began replacing foundational software with Rust alternatives in 2025, citing security benefits. Rust catches memory bugs at compile time, whereas C compilers do not. Ubuntu 25.10 was the first release to ship with Rust-based utilities and made Rust-based sudo the default.
The migration has required careful attention to security and compatibility. Canonical commissioned a security audit of uutils ahead of the 26.04 release, which identified the TOCTOU issues that kept the three commands on their GNU versions. The company is also a gold sponsor of the Trifecta Tech Foundation, contributing €40,000 annually to fund work on Rust software. The foundation is undertaking a Rust-based rewrite of the Network Time Protocol, which Ubuntu plans to adopt as the default time sync client by version 27.10.
For end users, the completion of the coreutils migration offers no functional difference. The Rust-based uutils aims for drop-in compatibility with GNU versions and treats any deviations as a bug—the objective is improved security rather than feature changes.
Ubuntu 26.10 ‘Stonking Stingray’ beta is scheduled to arrive later this month, with the stable release on October 15, 2026.
Key facts
- Ubuntu 26.10 completes migration of core utilities to Rust-based versions
- cp, mv, and rm were delayed on GNU versions due to TOCTOU security issues now resolved
- Rust-based utilities aim for drop-in compatibility with GNU versions with no functional changes to users
- Canonical is a gold sponsor of the Trifecta Tech Foundation, contributing €40,000 annually for Rust software development
- Ubuntu plans to adopt Rust-based Network Time Protocol as default by version 27.10