Ubuntu 26.04 LTS Ships Rust Core Utilities: What to Know

Ubuntu 26.04 LTS “Resolute Raccoon” is the first Ubuntu long-term support release to ship Rust-rewritten system tools as production defaults. sudo now runs on sudo-rs. Most of GNU coreutils — ls, cat, sort, wc, and dozens more — now run on uutils. With Ubuntu Pro’s 15-year support window, these Rust tools will underpin enterprise Linux deployments until 2041. This isn’t a distro experiment. It’s a policy decision, and it affects every developer running workloads on Ubuntu.

sudo-rs Is the New Default

sudo-rs replaces the original sudo binary in Ubuntu 26.04. For most developers — typing sudo apt install, running privileged scripts — nothing changes. The security posture, however, shifts considerably.

The original sudo has a long CVE history. CVE-2021-3156 was a heap buffer overflow reachable by any local user. CVE-2025-32463 and CVE-2025-32462 hit production deployments last year. Neither touched sudo-rs, because the vulnerable code paths do not exist in the Rust rewrite. Reduced feature set equals reduced attack surface — that’s the design.

The tradeoffs are real and worth knowing before you upgrade:

• Plugin API: Not supported. If your setup uses sudo plugins for auditing or custom auth, you’ll need alternatives.
• LDAP sudoers: Not supported. Enterprise environments backed by LDAP must stay on original sudo — the fallback package remains available.
• Wildcards in command args: Handled differently, intentionally, to prevent common sudoers misconfiguration.
• Missing env vars: SUDO_TTY and MAIL are not passed. Scripts that read these will silently get nothing.

sudo-rs has been independently audited twice (August 2023, August 2025). For standard /etc/sudoers configurations without plugins or LDAP, the transition is invisible.

uutils Replaces Most of GNU coreutils — But Not cp, mv, or rm

This is where the story gets interesting. Canonical switched the majority of coreutils to uutils, the Rust reimplementation. But cp, mv, and rm still ship as GNU binaries in 26.04. The reason: eight unresolved TOCTOU (time-of-check-to-time-of-use) race conditions in the uutils versions were judged too data-destructive to ship in a long-term support release. Canonical made the conservative call. That’s the right call.

uutils 0.11, released September 1, 2026, now passes 95.33% of the GNU test suite — up from 94.44% in 0.10, with 22 failing tests remaining (down from 28). For everyday shell use, the transition is invisible. For automation, it’s worth a test pass.

The places where the remaining 4.67% matters:

• ls flags — particularly --quoting-style and some color output options
• sort with locale-sensitive comparisons
• Scripts that parse specific GNU error message text (uutils messages differ)
• Date formatting edge cases across locales

If your CI pipeline runs on Ubuntu and involves shell scripts, run them on a 26.04 image before upgrading production. Most will pass. Some won’t.

What Comes Next

Canonical published a clear roadmap. In Ubuntu 26.10, cp, mv, and rm are slated to switch to uutils — assuming the TOCTOU work lands upstream. ntpd-rs, a Rust rewrite of the NTP daemon, will appear in the repos for testing. By Ubuntu 27.04, ntpd-rs is planned as the default. Ubuntu 28.04 LTS is expected to ship a substantially complete Rust system stack.

Canonical is backing this with money, not just roadmap slides. They joined the Rust Foundation as a Gold member in March 2026 and committed €40,000 per year to the Trifecta Tech Foundation — the organization maintaining both sudo-rs and ntpd-rs. Jon Seager, Canonical’s VP of Engineering, is keynoting RustConf 2026 (September 8–11, Montreal) on “Rust Adoption At Scale With Ubuntu.” These aren’t hobbyist commits to a side project.

Three Things to Check Before Upgrading

If you’re running Ubuntu servers or CI on 24.04 and planning to move to 26.04:

1. Audit your sudoers files. LDAP-backed configs, plugin references, and wildcard patterns may behave differently under sudo-rs. Test with sudo -l and verify privilege escalation paths manually.
2. Run your shell scripts on a 26.04 image. uutils covers 95.33% of GNU compatibility — but the edge cases cluster in ls, sort, and locale handling. Docker-based testing before migration is cheap insurance.
3. Check for SUDO_TTY and MAIL dependencies. Any script or tool that reads these env vars after a sudo invocation will get empty strings. Grep your codebase before you upgrade.

The bottom line: memory safety is becoming OS-layer infrastructure policy, not a library-level opt-in. Ubuntu 26.04 LTS with 15-year support is how that policy lands in production. The tools are ready for most use cases. The edge cases are documented. The fallbacks exist. There’s no reason to wait — but do test before you move.