Ubuntu 26.10 ships full Rust coreutils set after TOCTOU fixes clear cp, mv and rm

Ubuntu 26.10 will ship with a complete set of Rust-based core utilities, closing out a migration Canonical began in 2025. According to OMG! Ubuntu, the release, codenamed "Stonking Stingray", includes Rust versions of cp, mv and rm — the last three commands that had been kept on their GNU implementations for security reasons.

Why cp, mv and rm were held back

When Ubuntu 26.04 LTS arrived earlier this year, much of the coreutils stack had already moved to the Rust-based uutils project, but three of the most consequential tools stayed put. As OMG! Ubuntu reports, a security audit Canonical commissioned ahead of 26.04 uncovered a cluster of TOCTOU (time-of-check to time-of-use) flaws in the uutils versions. TOCTOU bugs arise when system state changes between a check and the action that follows it — a class of race condition with particular bite in tools that copy, move and delete files. Canonical held those three commands on their GNU versions until the problems were resolved upstream, and with the fixes landed, Ubuntu 26.10 completes the swap. The release carries Rust implementations of everyday tools including ls, cat, chmod and du alongside the three former holdouts.

A staged 'oxidisation' of the distro

Canonical started what it describes as oxidising the distribution — replacing foundational C components with Rust alternatives — in 2025. Ubuntu 25.10 was the first release to ship Rust-based utilities, and it also made a Rust implementation of sudo the default.

The effort extends beyond Canonical's own engineers. The company is a gold sponsor of the Trifecta Tech Foundation, contributing €40,000 a year to fund work on Rust software. That foundation is currently writing a Rust version of the Network Time Protocol, and according to OMG! Ubuntu, Ubuntu plans to adopt it as the default time-sync client by release 27.10. The report notes the migration has not been without hiccups, but that Canonical has been methodical throughout, auditing components before adopting them rather than swapping them in wholesale.

No functional change, by design

For end users, the completed migration changes nothing about how the tools behave. The uutils project aims to be a drop-in replacement for GNU coreutils and treats any deviation from GNU behaviour as a bug. That is deliberate: the point of the exercise is not new features but security. Rust catches memory bugs at compile time, whereas C compilers let them through to runtime — a meaningful difference in code paths that execute constantly on virtually every Linux system.

Release timeline

The Ubuntu 26.10 beta is due later this month, with the stable release scheduled for 15 October 2026, per OMG! Ubuntu.

Why it matters

coreutils is among the most-executed software on any Linux machine: every shell script, package operation and administrative task touches ls, cat, cp, rm or their siblings. A major distribution replacing that entire layer with memory-safe implementations is significant validation of Rust for foundational, cannot-break infrastructure — not just for new applications.

The rollout also models how such migrations should be run: pay for an independent audit, hold back the components that fail it, help fix the problems upstream, and only then complete the swap. The TOCTOU episode is a useful corrective to over-enthusiasm about memory safety, too — Rust eliminates whole categories of memory bugs, but not race conditions and logic flaws, which still require conventional auditing.

Finally, it signals that more is coming. With a Rust NTP client planned as the default time synchronisation tool by 27.10 and ongoing sponsorship of the Trifecta Tech Foundation, Ubuntu's Rust programme now reaches well past coreutils.