Ubuntu 26.10: cp, mv and rm Go Rust, and How to Switch Back to GNU

Ubuntu 26.10: cp, mv and rm Go Rust, and How to Switch Back to GNU

Ubuntu 26.10, codenamed Stonking Stingray, is scheduled for 15 October 2026. It is an interim release with nine months of support, so it is not the version you put on a server you want to forget about. It is the version that shows where the next LTS, Ubuntu 28.04, is heading. And this time the direction fits in three commands that every Linux user has typed thousands of times: cp, mv and rm.

What Ubuntu 26.10 Ships

GNOME 51 is the desktop, confirmed in the Canonical desktop roadmap. On the kernel, the Canonical kernel team first announced Linux 7.2 and then raised the target to 7.3, the release that brings the Btrfs and EXT4 performance work and the scheduler changes we covered in our Linux 7.3 preview. The development snapshots still carried 7.2, so run uname -r on your install to see which one you actually got.

The rest of the list is infrastructure rather than headlines. The message bus moves to dbus-broker. authd gains Microsoft multi factor authentication. NetworkManager gets PKCS#11 and smart card support. GStreamer 1.30 arrives with its Rust plugins, Mesa is on the 26.2 branch, systemd moves to the 261 series, and RISC-V gets a full desktop image. Python 3.14 remains the default, the same major version as 26.04.

One correction to what you may have read elsewhere. The redesigned installer and onboarding, the package agnostic App Center and on device speech to text are not 26.10 features. Canonical says explicitly in its roadmap that these projects target Ubuntu 28.04 LTS.

The Headline: cp, mv and rm Become Rust

Ubuntu has been moving its core utilities from GNU coreutils to uutils, a Rust reimplementation, since 25.10. In Ubuntu 26.04 LTS the switch covered almost everything, with three deliberate exceptions. cp, mv and rm stayed on GNU. On a default 26.04 system, ls --version answers uutils coreutils 0.8.0 while cp --version still answers GNU coreutils 9.7.

Ubuntu 26.10 removes the exceptions. The release notes describe it as 100 percent Rust coreutils, and the package in the archive is uutils 0.12.0. For the first time on a default Ubuntu install, every command in the core set, including the ones that copy, move and delete your files, comes from the Rust implementation.

Why Those Three Were Held Back

The reason is the most interesting part of this release, and it is pure sysadmin territory. Canonical commissioned the security firm Zellic to audit uutils in two rounds, from December 2025 to March 2026. The audit found 113 issues. How many of them received CVE identifiers depends on who you ask: Canonical lists a range of 47, the uutils maintainers and the oss-security disclosure count 44, and some coverage has reported 70. What nobody disputes is where the serious ones concentrated.

They were TOCTOU races, time of check to time of use, in recursive operations. The pattern is old and well understood: a tool checks a path, then acts on it, and in between an attacker swaps a directory for a symlink so the action lands somewhere else. The findings included races in cp, mv and install, a way to bypass --preserve-root in rm and chmod through path variants and symlinks, and a module injection issue in chroot. The uutils maintainers point out that these are behavioural bugs, not memory safety bugs. Rust protected the code from one class of mistakes and not from this one.

When 26.04 LTS shipped, eight of those TOCTOU issues were still open, so Canonical kept GNU for the three tools where a race does the most damage. uutils 0.9.0 then added a TOCTOU resistant copy module and fixed the races in cp, mv and recursive chmod. uutils 0.12.0, the version in 26.10, prioritised bugs reported by Ubuntu, including a data loss issue in install -D, name collisions in cp -R and symlink traversal in chmod -R.

One last detail shows how close to the wire this finish line was. On 14 September a bug report showed that rm -rf crashed with a segmentation fault on directory trees tens of thousands of levels deep, because the implementation was recursive. The fix, an explicit stack that keeps only the deepest directory descriptors open, was merged two days later and shipped in 0.12.0. The Beta Freeze was on 21 September.

Is My System Running Rust or GNU Coreutils?

The fastest check is the version banner. The first line names the implementation:

# prints "(uutils coreutils)" or "(GNU coreutils)"
cp --version | head -1

# which binary actually runs
readlink -f /usr/bin/cp

# which package owns it
dpkg -S /usr/bin/cp

With uutils active, readlink resolves into the multicall binary under /usr/lib/cargo/bin/. The GNU tools do not disappear: they stay installed with a gnu prefix, so gnucp, gnurm and their siblings are available when you need the original behaviour for a single command.

A Script Broke. How Do I Switch Back to GNU?

The provider is chosen by a package. Ubuntu builds coreutils-from-uutils and coreutils-from-gnu from the same source, and whichever is installed decides which implementation answers when you type cp. Because coreutils are an essential package, apt asks for an explicit flag:

# switch the whole set back to GNU coreutils
sudo apt install coreutils-from-gnu coreutils-from-uutils- --allow-remove-essential

# if apt refuses, install the package file directly
apt download coreutils-from-gnu
sudo dpkg --install ./coreutils-from-gnu*.deb

# return to the Rust implementation later
sudo apt install coreutils-from-uutils

If you want the choice to stick, add an apt pin so that uutils is never pulled back in by a dependency. Create /etc/apt/preferences.d/uutils with this content:

Package: coreutils-from-uutils
Pin: release a=*
Pin-Priority: -10

Two honest caveats. First, whether a GNU choice made on 26.04 survives the release upgrade to 26.10 is a question users have asked on the Ubuntu Discourse without an official answer yet, so check cp --version after upgrading rather than assuming. Second, switching the whole set back is the blunt option. If one script depends on one GNU behaviour, calling gnucp or gnusort in that script is the surgical fix, and it leaves the rest of the system on the default Canonical is going to support.

What Actually Behaves Differently

uutils 0.12.0 passes 653 of the 674 tests in the GNU coreutils test suite, about 96.9 percent. The remaining three percent is where scripts break. The differences reported on 26.04 are a good map of where to look:

The pattern is consistent. Anything that parses the human readable output of a core tool, or depends on locale sensitive ordering, is the first place to test. Anything that only uses exit codes and standard flags is very likely fine. If you maintain permission logic in deployment scripts, our chmod calculator is a quick way to double check the numeric modes those scripts set.

The Secure Boot Proposal to Watch

In March, Julian Klode proposed trimming the signed GRUB used for Secure Boot in 26.10: dropping btrfs, hfsplus, xfs and zfs as filesystems for /boot, the JPEG and PNG image modules, the Apple partition table module, and /boot on LVM, most md RAID levels and LUKS. The idea is a smaller attack surface for the code that runs before the kernel. Canonical staff clarified that full disk encryption as the installer sets it up is not affected, because an encrypted /boot was never an installer option. The Discourse thread was heated enough that moderators turned on slow mode. If your machines boot from a ZFS or XFS /boot, read the release notes on release day before you upgrade.

The Interim Release Is Doing Its Job

In our Ubuntu 26.04 LTS review the criticism was about timing, a kernel with eleven days of soak time committed to a ten year support window. 26.10 is the mirror image. The risky change, the three tools that can destroy data if they misbehave, lands in a nine month release that people install because they want to see the future, with a documented way back and an escape hatch in every script. That is the healthy version of moving fast, and it deserves to be said as clearly as the criticism was.

The Road to 28.04 LTS

Canonical has not said in writing that Rust coreutils will be the default in Ubuntu 28.04 LTS. Every signal points that way, from the direction of the last three releases to the rest of the memory safe replacements already in place, like sudo-rs. If it happens, April 2028 is when this change reaches servers that run for five or ten years, and the interim releases between now and then are the window to find out which of your scripts care. The practical advice is simple: add a 26.10 VM to your CI matrix now, not in 2028.

Rust Is Not a Security Guarantee

The Zellic audit is the most useful document in this whole story, because it punctures the lazy version of the argument on both sides. Rust did prevent the memory corruption bugs that have plagued C tools for decades. It did not prevent a single one of the race conditions that held 26.04 back, because those are logic bugs about the filesystem, and the GNU tools had fixed most of them years ago through painful experience. A rewrite in a safer language resets the memory safety clock to zero and the behavioural experience clock to zero at the same time. The first reset is a gift. The second one is a cost that only testing, audits and time can pay down, and Ubuntu is now paying it in public.

Published September 2026. This is an analysis and opinion piece, not a sponsored post. CodeHelper has no commercial relationship with Canonical Ltd.