Canonical has finished replacing GNU Core Utilities with uutils, a Rust reimplementation, in its default Ubuntu stack. The final three utilities – `cp`, `mv`, and `rm` – were migrated with the release of Ubuntu 26.10. This move is part of a larger effort by Canonical to improve the security and memory safety of Ubuntu through ‘rustification.’
Canonical began this process last year, with Ubuntu 25.10 becoming the first release to ship coreutils as the default. However, the migration slowed with Ubuntu 26.04 due to Time-of-Check-to-Time-of-Use (TOCTOU) issues discovered during security audits conducted by Zellic between December 2025 and March 2026. These audits identified 113 issues, with 44 receiving Common Vulnerabilities and Exposures (CVE) designations. Canonical states that the vast majority of these issues have now been resolved. A temporary setback occurred in July when `uutils cp` briefly broke live image builds, but a quick fix ensured its inclusion in the 26.10 release.
Users will not notice any immediate changes, as uutils coreutils is designed as a drop-in replacement for the GNU tools. However, some options may be missing or behave differently. Users who prefer the GNU versions can install the `coreutils-from-gnu` package. This change is one step in Canonical’s broader plan to enhance Ubuntu’s security through memory-safe system software. The company is now sponsoring the Trifecta Tech Foundation with €40,000 annually and is currently testing `ntpd-rs`, a Rust rewrite of the system’s clock synchronization tools, with a target default implementation in Ubuntu 27.04.
Read the original coverage
💬 Comments
📜 Comment Policy