A Coruña and the Quiet Rust-ification: How Linux Is Rewriting Its Own Foundations
If you ran Linux on NVIDIA graphics between about 2001 and 2012, you remember the ritual. A kernel upgrade would land, you would reboot, and the screen would come up at 640 by 480 in sixteen colours, or not at all. Somewhere on a forum was a fix involving a proprietary driver blob, a rebuilt kernel module, and a prayer. I have compiled more kernels than I can count, starting on a 486, and a good number of those recompiles were me trying to coax a closed NVIDIA driver back into speaking to a display it had worked with perfectly the day before. It was the price of performance graphics on Linux, and we paid it for a decade.
I thought about that ritual on 3 July 2026, when the GNOME project released GNOME 51 Alpha, codenamed "A Coruña" after the Spanish coastal city hosting this year's developer conference [1]. Buried in the release notes was a line that closes a chapter I lived through: GNOME has dropped support for the legacy NVIDIA EGLStream graphics path on Wayland [2]. That single decision is the visible tip of something much larger, and much quieter, that has been going on underneath all of us.
The house is being re-poured while it is occupied
Two episodes back, when I wrote about Linux 7.0 making Rust a first-class language in the kernel, the story was about the kernel itself. The argument then was straightforward: roughly two-thirds of serious kernel vulnerabilities are memory-safety bugs, the kind where C lets a program read or write memory it should never touch, and Rust's ownership model makes that class of mistake fail to compile rather than fail in production. Last month's Android data made the same point from the field: memory-safe code cut memory-safety vulnerabilities from most of the total to about a third over three years.
What has changed in 2026 is where the work is happening. The Rust-ification has crossed the kernel boundary and reached the tools every Linux user touches. Not in one dramatic rewrite. Component by component, while the system keeps running.
Start with the one nobody expected to move. In Ubuntu 26.04 LTS, the long-term-support release, the default sudo and su are no longer the 44-year-old C sudo that has guarded the root prompt on Unix systems since 1980 [3]. They are sudo-rs, a ground-up Rust rewrite built by the Trifecta Tech Foundation, which grew out of the Internet Security Research Group's memory-safety initiative, the same non-profit behind Let's Encrypt [4]. Ubuntu is the first major distribution to ship it as the system default. From where you sit, nothing changes: the syntax is identical, your sudoers file works untouched, and the authentication plumbing behaves the same. The 44-year-old foundation slab was swapped out under the house, and the occupants had dinner without noticing.
Time synchronisation is next in the queue. Canonical has become a gold sponsor of the Trifecta Tech Foundation, committing forty thousand euros a year to fund memory-safe replacements for core infrastructure [5][6]. The target is ntpd-rs, a Rust rewrite of the Network Time Protocol daemon, slated for testing in Ubuntu 26.10 and lined up to become the default time-synchronisation tool in Ubuntu 27.04. I want to be precise here, because the difference matters: ntpd-rs is funded, scheduled, and being tested. It is not yet the default in any shipped Ubuntu release; that remains chrony for now. This is a plan with money behind it, not a fact on the ground. But money behind a plan is how the kernel got here too.
Then there is the driver that started this reflection. Nova is a Rust-based open-source driver for modern NVIDIA graphics processing units, built around the GPU System Processor architecture that recent NVIDIA hardware uses [9][10]. It is split into nova-core, which talks to the hardware, and nova-drm, the layer that talks to userspace. Red Hat's Danilo Krummrich maintains it upstream, and it dominates the Rust driver work going into the Linux 7.2 cycle. NVIDIA is contributing to it directly, with support for its newer architectures advancing, though the specific hardware milestones are still moving and worth checking at the time you read this. Here is the connection back to A Coruña: by dropping EGLStream, GNOME 51 Alpha commits fully to the open DMA-buffer path, using Generic Buffer Management for allocation and Kernel Mode Setting for the kernel handoff, the same path AMD and Intel have always used, and the same path the modern NVIDIA open drivers, including Nova, are built around [2]. The proprietary extension I fought with for a decade is being retired because the open replacement finally works.
Why bother, when it already works
There is a fair question underneath all of this. sudo works. C sudo has guarded the root prompt for four decades. Why rewrite forty years of hardened, audited code in a new language?
The answer arrived, as these answers usually do, wearing a CVE number. In June 2026, kernel maintainers patched a bug the security community named Januscape, catalogued as CVE-2026-53359 [7][8]. It is a race condition in the memory-management unit of KVM, the Kernel-based Virtual Machine subsystem that runs virtual machines on nearly every Linux cloud host. Under the right timing, a guest virtual machine can drive the host into mapping memory the guest controls, and from there escape its own boundary to run code as root on the host itself. A tenant of one apartment gets the keys to the whole building.
The detail that should stop any architect cold: the bug was introduced in 2010. It has been present in essentially every Linux kernel shipped for sixteen years, across both Intel and AMD processors, patched only in June 2026 with two coupled fixes that had to land together to close it properly [8]. Sixteen years of a real memory-management confusion bug, sitting quietly in production, in the exact code path that runs the world's cloud infrastructure. This is not a theoretical risk anyone invented to sell a language. It is the class of mistake that a borrow checker refuses to compile.
That is the whole argument, made concrete. Januscape is a frame-number and page-table confusion under a race, and Rust's ownership and borrowing rules are designed to make precisely that category of error impossible before the code ever ships. You cannot patch your way out of a class of bug. You can only design it out. That is what the quiet rewrite is buying.
From reduction to elimination
For years the honest case for memory-safe languages was about reduction, not elimination. Fewer bugs, not no bugs. That is starting to shift. Google has reported zero memory-safety bugs in production from the Rust driver code it has deployed in Android so far, including the shared-memory subsystem shipping fully in Rust on Android 16 devices, across millions of handsets [11]. I would qualify that carefully, and so does Google: this is a reported figure for the code deployed to date, not a mathematical proof that no such bug can ever occur. But there is a difference between a class of bug you fight forever and a class of bug that has stopped appearing. The Android field data and the Januscape patch are the two ends of the same sentence.
This is not a grassroots patching effort, and it is worth understanding that it is organised. sudo-rs and ntpd-rs both began as projects funded through the Internet Security Research Group's memory-safety programme before moving to the Trifecta Tech Foundation, and Canonical's sponsorship brings corporate money into the same coordinated effort [5][11]. It is a funded, structured project to replace memory-unsafe foundations across the Linux software stack, one utility at a time, on a published schedule.
And the queue does not end with these four. Canonical has been open that the wider aim is to move more of Ubuntu's base system onto memory-safe foundations over time, and projects like uutils, a Rust reimplementation of the classic core utilities, sit further down the same road. There is even active work on a Rust front end for GCC, the GNU Compiler Collection, which would loosen today's dependence on a single Rust toolchain. I would not overstate any of it. Most of it is early, and some of it is a stated direction rather than a shipped default. But the pattern is consistent: identify a memory-unsafe foundation, fund a memory-safe replacement, and swap it in on a published schedule while the system keeps serving.
There is a New Zealand thread in this for me. I have spent thirty years watching organisations here defer known infrastructure risk because the system was running and nobody wanted to touch it. The deferral almost always ends the same way: not with a considered upgrade on a quiet Tuesday, but with an outage, an incident report, and a scramble to replace under pressure what could have been replaced in calm. The Rust-ification is the opposite instinct at civilisational scale: replace the load-bearing pieces before they fail, while the building stays occupied, and accept the disruption of the rebuild rather than the disruption of the collapse. That is a governance posture, not just an engineering one, and it is the same posture I have spent a career arguing for in boardrooms that preferred to wait.
The bridge to now
GNOME 51 A Coruña is a small headline about a graphics extension being removed. What it signals is larger. sudo-rs is already the default in an LTS release millions will run for years. ntpd-rs is funded and scheduled. Nova is advancing in the current kernel cycle. The desktop has cut its last tie to the legacy proprietary graphics path. The language war that Episode 17 traced through thirty years of argument has effectively been settled at the institutional level: Rust has been recognised as a memory-safe language by the major standards and security bodies, and the Android, Windows, and Linux kernels all now carry Rust in production. What remains is the long, unglamorous implementation, and that implementation has now reached your sudo prompt.
The foundations are being re-poured while the house stays occupied, one slab at a time, and most of the occupants never notice the work. That is the highest compliment you can pay an infrastructure project.
The procurement-side question follows the same line without needing to be forced. The move to memory-safe foundations is no longer only an engineering preference; it has become a written expectation in government-adjacent software. The United States Office of the National Cyber Director, the ONCD, argued in its February 2024 report "Back to the Building Blocks" that software makers should shift away from memory-unsafe languages [12]. The National Security Agency, the NSA, had already published guidance recommending memory-safe languages, and the Cybersecurity and Infrastructure Security Agency, the CISA, has pressed a memory-safe-by-design roadmap and folded it into Software Bill of Materials expectations under Executive Order 14028 [13][14]. When a distribution ships sudo-rs by default, it is not only fixing a bug class. It is meeting a procurement expectation that allied governments are writing into the software they will buy. The occupants at dinner include some very large institutions.
Have you ever had to replace the foundations of a system that could not go offline? What did that teach you about the cost of decisions that seemed fine at the time?
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. They do not represent the views of my employer, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance. I follow the Public Service Commissioner's Code of Conduct for the Public Sector and social media guidance.
About the Author: Andreas Hamberger is a New Zealand-based enterprise architect and technology strategist. Over 30 years, he has moved from compiling kernels on a 486 to leading cloud, cyber, and AI transformation programmes across government, banking, transport, and aviation. He founded Yoper Linux, served as a technology specialist for Novell during the Linux Wars, and is the author of "Generative AI: Skynet or Heaven" and "Space Mafia." He can be reached at linux@linux.co.nz. A Concise History of Linux chronicles the operating system that changed the world and the lessons it holds for the AI era.
I use AI tools, including Sudowrite, Claude, Perplexity AI, DeepSeek AI, ChatGPT, Grok, Copilot, Openart and Gemini, as deliberate production tools, not ghostwriters. This is consistent with my position: AI amplifies human judgement; it does not replace it. The frameworks, arguments, and editorial decisions in this series are original work. AI accelerated the process. The thinking is mine.
References
[1] GNOME Project. "GNOME 51.alpha Released." GNOME Discourse. 3 July 2026. https://discourse.gnome.org/
[2] Larabel, M. "GNOME 51 Alpha Released With Numerous Enhancements." Phoronix. 3 July 2026. https://www.phoronix.com/
[3] Nestor, M. "GNOME 51 Alpha 'A Coruña' Desktop Environment Scheduled for September 16th." 9to5Linux. 3 July 2026. https://9to5linux.com/
[4] Ubuntu Community Hub. "Adopting sudo-rs by Default in Ubuntu." Canonical Discourse. 2026. https://discourse.ubuntu.com/
[5] Trifecta Tech Foundation. "Ubuntu to adopt ntpd-rs as the default time synchronization client and server." trifectatech.org. 2026. https://trifectatech.org/
[6] It's FOSS. "Canonical Puts 40,000 Euros a Year Behind Trifecta Tech to Rustify Ubuntu." itsfoss.com. 2026. https://itsfoss.com/
[7] The Hacker News. "16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host." 2026. https://thehackernews.com/
[8] CloudLinux. "Januscape CVE-2026-53359: Mitigation and Kernel Update on CloudLinux." CloudLinux Blog. 2026. https://blog.cloudlinux.com/
[9] Larabel, M. "NVIDIA's Nova Driver Continues Being Built Up In Linux 7.2 Along With Other DRM Rust Code." Phoronix. 2026. https://www.phoronix.com/
[10] Linux Kernel Documentation. "nova." docs.kernel.org. 2026. https://docs.kernel.org/gpu/nova/index.html
[11] ISRG Prossimo. "Memory Safety for the World's Largest Software Project." memorysafety.org. 2026. https://www.memorysafety.org/
[12] Office of the National Cyber Director. "Back to the Building Blocks: A Path Toward Secure and Measurable Software." The White House. February 2024. https://www.whitehouse.gov/oncd/
[13] Cybersecurity and Infrastructure Security Agency. "The Case for Memory Safe Roadmaps." CISA. 2023. https://www.cisa.gov/
[14] National Security Agency. "Software Memory Safety." Cybersecurity Information Sheet. November 2022. https://media.defense.gov/