Ubuntu 26.10 Rust Coreutils: cp, mv, rm Finally Land

Ubuntu 26.10 “Stonking Stingray” ships the full Rust coreutils suite — including cp, mv, and rm — completing a migration that stalled on a security audit that found 70 CVEs. The three holdouts are now powered by uutils 0.9.0, which in May introduced a TOCTOU-resistant copy module and patched the race conditions that forced Canonical to keep GNU versions in 26.04 LTS. The stable release lands October 15. Here is what changed, what to check, and what Canonical is not advertising.

Why Three Commands Held Out for an Entire LTS Cycle

This was not squeamishness. Before shipping 26.04 LTS, Canonical commissioned Zellic to audit the uutils codebase. Zellic found 113 issues; 70 received CVE numbers. The most serious concentrated in cp, mv, and rm: TOCTOU race conditions in recursive operations, a symlink-protection bypass in rm and chmod, and a critical chroot vulnerability that allowed NSS code injection before a process dropped elevated privileges. Rust’s type system does not prevent TOCTOU bugs — those live in logic, not memory layout — so the audit found real problems, and Canonical made the conservative call.

That fix arrived May 30, 2026, with uutils 0.9.0. The release introduced uucore::safe_copy, a new module designed from the start to resist TOCTOU attacks, and applied the same resistant traversal logic to recursive cp, mv, and chmod. It also hardened rm against dot and dotdot path-parsing tricks. Ubuntu 26.10 picks up this work and ships 100% uutils — the first major Linux distribution to do so.

What Developers and Sysadmins Need to Check

The design goal of uutils is drop-in GNU compatibility, and it hits that target for the vast majority of use cases. Scripts using standard flags on standard files should work unchanged. However, four behavioral differences are worth knowing before October 15:

• uname -p returns “unknown” — replace with uname -m in any script that reads processor type.
• stat field names are lowercase — GNU uses uppercase. Scripts parsing stat output with awk or grep may silently return nothing.
• sort collation differs in non-POSIX locales — add export LC_ALL=C at the top of any sort-dependent pipeline to get deterministic behavior.
• env -S escape handling is stricter — shebangs using complex escape sequences can break with “No such file or directory” errors.

One unresolved issue: NFS compatibility. Users in research computing environments have reported file attribute problems on NFS-mounted filesystems that are not yet fixed upstream. If your workload is NFS-heavy, stay on GNU for now. The escape hatch remains easy:

# Switch to GNU coreutils
sudo apt install coreutils-from-gnu

# Or call GNU binaries selectively in hybrid mode
gnucp -a src/ dst/
gnusha256sum large-file.iso

For containers and CI, test against the 26.10 beta before the stable release. Docker images based on Ubuntu will silently pick up the new binaries on the next rebuild — worth catching in staging rather than production.

The Part Canonical Is Not Publicizing

Two things worth noting that did not make Canonical’s announcement post. First, the licensing shift. uutils is MIT-licensed; GNU coreutils is GPL. That distinction matters because MIT allows forks to incorporate changes without contributing them back upstream. Critics on Hacker News drew a direct line to 1980s Unix fragmentation: when vendors could modify system utilities and keep the changes proprietary, compatibility diverged fast. The GPL exists specifically to prevent that. uutils’ MIT license means Ubuntu — or anyone building on top of it — could modify core file utilities without the obligation to share.

Second, communication. GNU coreutils maintainer collinfunk noted publicly that Canonical “did not reach out to any of us who maintain GNU coreutils before, after, or during the transition.” No warning, no coordination, no chance to surface incompatibilities early. For a change affecting millions of systems, that is a process failure worth flagging. Meanwhile, Microsoft made Rust a Tier-1 language just days ago — Canonical’s move lands in a week where Rust’s institutional momentum is accelerating. Whether that validates the choice or raises the stakes depends on your perspective.

The Bigger Bet

Coreutils is one part of Canonical’s broader “oxidizing Ubuntu” push. The company funds the Trifecta Tech Foundation — €40,000 per year — which is also backing a Rust rewrite of the Network Time Protocol. The argument is straightforward: Rust eliminates memory-corruption bugs at compile time, and memory corruption remains the dominant class of exploitable vulnerability. Replacing C foundations with Rust foundations is a decade-long security investment, not a feature sprint.

No other major distribution has followed. Fedora, Debian, and Arch have not committed to uutils. Ubuntu is running this experiment alone. Whether that makes it a pioneer or a cautionary tale depends on how the compatibility edge cases shake out over the next 18 months.

The 26.10 stable release is October 15. The beta arrives later this month. If you manage Ubuntu systems, that is your testing window — run your scripts, check your containers, and decide whether to install coreutils-from-gnu as a precaution or trust that uutils 0.9.0 held up its end of the audit.