By Ubuntu 26.10 has finished what Ubuntu 25.10 started: every default coreutil is now Rust. The final three GNU holdouts — cp, mv, and rm — ship from the uutils project starting this cycle. GNU coreutils still exist on Ubuntu, but they’re now a package you opt into, not the default you’ve relied on since the 1990s.
The announcement reads as a clean security win. The path here was messier than that.
Why These Three Commands Took So Long
cp, mv, and rm were deliberately held back from both Ubuntu 26.04 LTS and Ubuntu 25.10. The uutils Rust implementations had TOCTOU (time-of-check to time-of-use) race conditions — the exact class of bug that Rust is supposed to make impossible.
Canonical commissioned security firm Zellic for two audit rounds between December 2025 and March 2026. Result: 113 issues found, 44 assigned CVEs. Race conditions in mv‘s cross-device copy logic, touch‘s file creation, and mkfifo‘s permission-setting created windows where local attackers could swap symlinks mid-operation. uutils 0.9.0, released May 2026, introduced a TOCTOU-resistant copy module that closed the races. With that fix in place, Ubuntu 26.10 had its blocker removed.
Credit Canonical for auditing before shipping, not after. That said, 44 CVEs in Rust replacements for tools hardened over four decades is a data point worth sitting with before declaring Rust categorically safer by default.
What Actually Changed for You
For most users: nothing visible. uutils targets GNU drop-in compatibility and delivers on it for the vast majority of workloads. The edge cases are real, though:
- Locale-sensitive sorting: UTF-8 accented characters sort in a different order. Pipelines checking sorted output against expected results may break silently.
statoutput format: Labels are lowercase in uutils. Scripts parsingstatoutput will fail if they match against uppercase field names.uname -p: Returnsunknowninstead of the CPU architecture string.- Performance split:
catruns roughly 2.3x faster;sha256sumruns roughly 2.3x slower.
uutils treats every divergence from GNU behavior as a bug to fix. That’s the right policy — but it doesn’t protect you when a deployment pipeline breaks on upgrade day before the fix lands.
To check which implementation is running:
cp --version | head -1
dpkg -S /usr/bin/cpStaying on GNU If You Need To
Canonical made the exit clean. GNU coreutils are available via the coreutils-from-gnu package:
sudo apt install coreutils-from-gnu coreutils-from-uutils- --allow-remove-essentialIf apt refuses due to essential package marking, install directly:
apt download coreutils-from-gnu
sudo dpkg --install ./coreutils-from-gnu*.debFor surgical use — keeping Rust as default while calling GNU in specific scripts — the prefixed binaries (gnucp, gnurm, gnusort) are available without switching everything. This is the right call for production systems where you need one or two GNU-specific behaviors without a full rollback.
The Oxidation Roadmap Continues
Coreutils is one piece. Ubuntu 25.10 shipped sudo-rs as the default sudo replacement; 26.04 LTS carried that forward. Ubuntu 27.04 is slated to make ntpd-rs the default NTP daemon — Canonical became a Gold Sponsor of the Trifecta Tech Foundation (the non-profit behind ntpd-rs) earlier this year. Let’s Encrypt has run ntpd-rs in production since June 2024.
The pattern: identify a critical C utility, find or sponsor a well-audited Rust replacement, include as optional, then flip to default. Ubuntu is methodically replacing its C foundation one component at a time.
The License Shift Nobody’s Discussing
uutils is MIT-licensed. GNU coreutils is GPLv3. This is not a footnote.
GPLv3 requires that derivative works remain open source. MIT does not — anyone can fork uutils, modify it, and ship it in a proprietary product without releasing their changes. For Canonical, which sells Ubuntu-based commercial services, permissive licensing in the OS foundation is a material business advantage.
The Rust migration is technically sound. But the license shift from copyleft to permissive is at least as significant as the language change, and it’s receiving a fraction of the coverage. Critics calling this “getting rid of everything GNU… simply because of the license” are not being paranoid — they’re reading the incentive structure correctly. Both things can be true: the Rust transition is the right technical move and it happens to serve Canonical’s commercial interests. That’s worth knowing.
What to Do Now
On Ubuntu 26.10 (beta now, stable October 15): audit scripts relying on sort, stat, or uname -p output parsing. Test file operations in race-sensitive environments. Use coreutils-from-gnu or prefixed GNU binaries where compatibility is non-negotiable. Check itsfoss’s full breakdown and OMG Ubuntu’s coverage for additional context.
On Ubuntu 26.04 LTS: not affected yet. cp, mv, and rm remain GNU on LTS. But the direction is set — plan for Rust coreutils in your next upgrade cycle.
