The Rust Revolution: How the Linux Kernel is Embracing a Memory-Safe Future

Executive Summary: A Tectonic Shift in Kernel Development

At the Open Source Summit India 2026 in Mumbai, Greg Kroah-Hartman, the long-standing maintainer of the Linux stable kernel branch, delivered a keynote that signaled a definitive end to the "C-only" era of the world’s most important operating system. Titled "Rust and Linux: How the Rust Language is Going to Help Linux Succeed," the address marked a total pivot for Kroah-Hartman, who transitioned from a self-described Rust skeptic to one of the language’s most vocal proponents within the kernel community.

The core of the announcement was staggering: Rust is no longer considered an experimental feature of the Linux kernel; it is now a fundamental pillar of its security strategy. Kroah-Hartman revealed that for certain critical subsystems, new drivers will henceforth only be accepted if written in Rust. This policy change, combined with the news that the Android Binder—the communication backbone for billions of devices—is being fully migrated to Rust, underscores a massive transition in how the global digital infrastructure is secured.

Main Facts: From Skepticism to Adoption

The transition of Linux, a project comprising over 30 million lines of C code, toward a modern language like Rust is not merely a technical update; it is a cultural and philosophical shift. Kroah-Hartman’s keynote highlighted several critical data points and policy shifts that define this new era:

The "Rust-Only" Mandate

Perhaps the most significant revelation was the decision to restrict certain subsystems to Rust-only development. While the kernel has historically been inclusive of various styles of C, the inherent dangers of manual memory management have led maintainers to a breaking point. By mandating Rust for new drivers in specific areas, the kernel team aims to prevent "legacy" bugs from being introduced into the codebase from day one.

The Retirement of C-based Binder

Binder is the Inter-Process Communication (IPC) mechanism at the heart of the Android operating system. For years, a C implementation has handled the delicate task of moving data between apps and the system. Kroah-Hartman confirmed that parallel C and Rust versions currently exist, but the C version is slated for removal. The Rust implementation will become the "bedrock" of Android security, handling some of the most sensitive data-passing tasks in the mobile ecosystem.

The Human Element: Making Programming "Fun"

In a candid moment, Kroah-Hartman admitted his initial resistance to the language. "A number of years ago… I was like, ‘What? No, C is great,’" he told the audience. His conversion came through the realization that Rust offloads the cognitive burden of memory management to the compiler. By allowing the compiler to catch "trivial" bugs, developers are freed to focus on high-level logic, which Kroah-Hartman claims has made kernel development "fun" again.

Chronology: The Journey to Rust for Linux

The path to integrating Rust into the Linux kernel has been a multi-year saga of rigorous debate, technical hurdles, and gradual acceptance.

• 2020–2021: The Initial Proposals: The "Rust for Linux" project, led by Miguel Ojeda, began as a grassroots effort. Early discussions on the Linux Kernel Mailing List (LKML) were met with significant pushback from veteran developers concerned about toolchain stability and the overhead of supporting a second language.
• 2022: Linux 6.1 – The First Step: Linus Torvalds officially merged initial Rust support into the 6.1 kernel. At the time, it was strictly experimental, providing only the infrastructure needed to build Rust code without any actual user-facing drivers.
• 2023–2024: Infrastructure Building: This period saw the development of "wrappers"—abstractions that allow Rust code to safely interact with the existing C kernel APIs. Key drivers, such as those for NVMe storage and the Asahi Linux project’s Apple Silicon GPU drivers, began to show that Rust could match C in performance while providing superior safety.
• 2025: Maturity and Integration: The toolchain (specifically rustc and the integration with bindgen) reached a level of stability that satisfied the "stable" maintainers. Development of the Rust-based Binder reached parity with the C version.
• 2026: The Mumbai Declaration: Greg Kroah-Hartman’s keynote at the Open Source Summit India officially cements Rust’s status. The transition moves from "optional experiment" to "architectural requirement."

Supporting Data: The High Cost of C Mistakes

Kroah-Hartman’s advocacy is driven by cold, hard data. As the maintainer of the stable branch, he sees the "underbelly" of the kernel—the endless stream of security vulnerabilities that require constant patching.

The 13-CVE-a-Day Reality

Linux is an incredibly fast-moving target. Kroah-Hartman noted that the kernel has been averaging nearly nine changes per hour for over a decade. This velocity, while impressive, comes with a cost: an average of 13 Common Vulnerabilities and Exposures (CVEs) per day.

The 80% Solution

Upon analyzing 25 years of kernel vulnerabilities, Kroah-Hartman made a bold claim: 80% of these CVEs could have been prevented by Rust.
The vast majority of these bugs are not complex logic errors; they are "stupid little tiny things" inherent to C:

• Use-After-Free: Accessing memory after it has been deallocated.
• Double Frees: Attempting to deallocate memory twice, leading to heap corruption.
• Unchecked Pointers: Dereferencing null or invalid pointers.
• Sloppy Cleanup Paths: Forgetting to unlock a mutex or free a buffer when an error occurs in the middle of a function.

By using Rust’s ownership and borrowing system, these errors are caught at compile-time. If the code is unsafe, it simply will not compile, effectively wiping out the category of "trivial" memory bugs that currently dominate the security landscape.

Official Responses and Industry Alignment

The push for Rust in the kernel does not exist in a vacuum; it is part of a broader global movement toward memory-safe programming.

The Google and Android Perspective

Google has been a primary financier and technical contributor to the Rust for Linux project. For Google, the motivation is clear: Android security. By replacing C components with Rust, Google has already seen a dramatic decrease in memory-safety vulnerabilities in the Android userspace. Bringing that same safety to the kernel is the logical next step in protecting billions of users.

Government and Regulatory Support

In recent years, agencies such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the White House Office of the National Cyber Director (ONCD) have issued reports urging the industry to move away from "memory-unsafe" languages like C and C++. Kroah-Hartman’s stance aligns the Linux project with these global security standards, ensuring that Linux remains a viable, secure choice for government and critical infrastructure.

The Developer Community

While there is still a "vocal minority" of C purists, the tide has turned. Younger developers, who are increasingly trained in modern languages, find Rust’s safety guarantees and modern tooling (like the Cargo package manager) more appealing than the manual rigors of C. Kroah-Hartman’s endorsement serves as a bridge, reassuring the "old guard" while welcoming the new generation.

Implications: A New Era for Systems Programming

The permanent integration of Rust into the Linux kernel has profound implications for the future of technology:

1. The Redefinition of "Kernel Developer"

The barrier to entry for kernel development is changing. Future maintainers will need to be bilingual, proficient in both the legacy C that makes up the majority of the kernel and the Rust that will define its future. This will likely lead to a period of "re-skilling" across the industry.

2. Hardware Vendor Accountability

Hardware vendors (like Intel, AMD, and NVIDIA) who write drivers for Linux will now face pressure to adopt Rust. If the kernel maintainers refuse C-based drivers for certain subsystems, vendors will have no choice but to modernize their software stacks. This will result in more stable, less "crashy" drivers for end-users.

3. Focus on Logic, Not Plumbing

By automating memory safety, the most talented minds in kernel development—people like Kroah-Hartman and Torvalds—can stop spending their time reviewing "trivial" pointer bugs. Instead, they can focus on the remaining 20% of bugs: complex logic errors, race conditions, and architectural improvements that actually advance the state of computing.

4. Long-term Maintenance Stability

The "stable" kernel branch will benefit immensely. Fewer memory-safety bugs mean fewer emergency patches and backports. This creates a more predictable environment for enterprise Linux distributions (like Red Hat, SUSE, and Ubuntu) and the cloud providers that rely on them.

Conclusion: Rust Never Sleeps

Greg Kroah-Hartman’s keynote in Mumbai marks a historic "coming of age" for Rust within the Linux ecosystem. By admitting his own past skepticism and highlighting the undeniable security benefits, Kroah-Hartman has signaled that the transition is no longer a matter of if, but how fast.

As the C implementation of Binder fades away and Rust becomes the standard for new drivers, the Linux kernel is effectively undergoing a heart transplant while running a marathon. It is a risky, complex, and necessary evolution. In the words of Kroah-Hartman, the goal is simple: to make the kernel better, to make the maintainers’ lives easier, and to ensure that Linux remains the "bedrock" of the modern world for the next 25 years. The message from the 2026 Open Source Summit is clear: The future of Linux is safe, and that safety is written in Rust.