Ubuntu 26.10 Replaces cp, mv, rm with Rust: 4 Script Traps & How to Roll Back

One Line in the Release Notes Hides a Major Shift

Ubuntu 26.10's release notes quietly added a single line: 100% Rust coreutils . The default core utilities now run entirely on the Rust implementation uutils. The previously retained GNU tools — cp, mv, rm — have finally been migrated.

This means that from Ubuntu 26.10 onward, the cp, mv, rm commands you type daily are no longer the GNU versions that have accompanied Linux users for decades, but Rust rewrites from the uutils project.

This Has Been Two Years in the Making

Canonical has been pushing Rust adoption for a long time. The timeline:

2025, Ubuntu 25.10 : First version to enable Rust coreutils by default. Commands like ls, cat, chmod, du switched to uutils. sudo was also replaced by Rust's sudo-rs.

April 2026, Ubuntu 26.04 LTS : Progress stalled. cp, mv, rm were explicitly kept on GNU versions.

October 2026, Ubuntu 26.10 : The three laggards finally caught up.

The whole transition took nearly two years. Why did these three commands fall behind?

Why These Three Commands Were Delayed a Full Year

1. One Audit Uncovered Over a Hundred Issues

Before the 26.04 LTS release, Canonical commissioned security firm Zellic to audit the uutils codebase. The audit ran in two rounds from December 2025 to March 2026, focusing on the most security-critical tools.

Result: Zellic reported 113 issues, many assigned CVE identifiers (media reports vary between 44 and 70 CVEs; Canonical says the vast majority are fixed). Crucially, the most severe issues clustered in cp, mv, rm:

TOCTOU races in recursive operations (detailed below)

Symbolic-link protection bypass in rm and chmod NSS code injection in chroot scenarios, allowing code injection before privilege drop

These commands directly manipulate user data. A vulnerability here means files deleted, replaced, or read incorrectly — not just a system hiccup. For a five-year LTS release, shipping with such flaws was unacceptable, so Canonical made the conservative choice: on 26.04, these three reverted to GNU versions.

2. A Quick Primer on TOCTOU

TOCTOU (Time-of-Check to Time-of-Use) means the moment you check a condition differs from the moment you act on it.

Example: Your program wants to delete a file. It checks — "file is in directory A, permissions OK, can delete." Check passes. But in the instant before execution, someone replaces directory A with a symlink to /etc. The program proceeds based on the stale check and deletes the wrong location.

The check-to-use gap is tiny but exploitable.

Important: Rust cannot prevent this class of bug. Rust's memory safety guarantees stem from its type system and ownership model, covering memory-layout errors (out-of-bounds, use-after-free, double-free). TOCTOU is a logic-level race ; memory safety does not stop "the file was swapped after the check." The audit uncovered genuine logic defects that cannot be fixed merely by switching languages — hence the long remediation period.

3. The Turning Point Arrived in May

The breakthrough came with uutils 0.9.0 (released 30 May 2026). This version introduced a new module, uucore::safe_copy, designed from the ground up to resist TOCTOU rather than patched afterward. The same race-resistant traversal logic was applied to recursive cp, mv, and chmod; rm gained hardened defenses against path-resolution tricks involving . and ...

With this foundation, 26.10 could ship the full suite. The path wasn't smooth: in July 2026, uutils 's cp was briefly moved to archive and then restored after it broke live-image builds — a Critical issue fixed quickly and pushed upstream, just in time for 26.10.

Does This Affect You? It Depends.

Interactive Use: Mostly Invisible

If you manually run commands like cp a.txt b.txt, rm old.log, mv dir1 dir2, you will likely notice no difference. The uutils project treats any observable deviation from GNU coreutils as a bug, not a design decision. Daily operations are safe.

But Scripts Have Four Traps You Must See

Automation relies on exact behavior — precise exit codes, output formats, error messages. GNU coreutils has decades of parameter behaviors and edge cases; a reimplementation achieving 100% parity is extremely hard. Four known traps currently exist:

Trap 1: uname -p returns unknown

GNU returns the processor type; uutils returns unknown. Any script reading this field gets an empty result. Fix: use uname -m instead.

Trap 2: stat field names become lowercase

GNU uses uppercase field names; uutils uses lowercase. If you parse stat output with awk or grep, it silently returns nothing — no error, just wrong results. This is the most insidious kind: the script continues but produces incorrect data.

Trap 3: sort ordering differs under non-POSIX locales

The same dataset may sort differently than before. Fix: prepend export LC_ALL=C to any pipeline that depends on sort to guarantee deterministic behavior.

Trap 4: env -S escaping is stricter

Scripts using complex escape sequences in shebang lines may fail with No such file or directory.

One unresolved issue: NFS. In HPC and other NFS-heavy environments, users report file-attribute anomalies; upstream has not yet fixed them. If your workload runs on NFS, stay on GNU versions for now.

Containers and CI Need Extra Attention

Docker images based on Ubuntu will silently swap these binaries on the next rebuild. You haven't changed the Dockerfile or base-image tag — just rebuilt — and cp is already different. Run your pipelines against the 26.10 Beta in staging first; don't wait for production to break.

Don't Want It? Two Escape Hatches

Escape Hatch 1: Full Rollback to GNU

sudo apt install coreutils-from-gnu

Install this and the original GNU binaries return. When automation breaks and you can't diagnose immediately, install this to unblock, then investigate later.

Escape Hatch 2: Per-Command GNU Calls

Don't want a full rollback? Use the gnu prefix for individual commands:

gnucp -a src/ dst/
gnusha256sum large-file.iso

Fine-grained control down to a single command. Save these commands before you put 26.10 on test machines; hunting them down during a 3 AM production incident is too late.

The Controversy: It's Not Just Technical

There's an unavoidable layer: the license changed.

GNU coreutils is GPLv3 (copyleft, requiring derivatives to stay open). uutils is MIT (permissive, almost no restrictions).

The migration effectively means: the most popular desktop Linux distro has switched its default user-space core tools from copyleft to a permissive license.

This shift didn't happen via a public policy statement. It accumulated through a series of "individually reasonable engineering decisions" — memory safety, modernization, maintainability — each defensible on its own.

Community reactions split:

Pro: Reward the side that delivers working code. Rust versions have run in front of real users for a year; issues were caught and fixed instead of rotting in an LTS. 26.10 is a non-LTS release — the right place to discover remaining breakage.

Con: The terms that kept these tools free are being diluted, all without a single public debate.

Both sides have merit, and neither has convinced the other. The real test isn't 26.10 — it's 28.04 . By then, whatever lands must be supported for years, and cp written in Rust will have been around long enough that most people stop noticing it.

Next Steps: Ubuntu's "Oxidation" Continues

Coreutils is just one move in a larger game. Canonical's roadmap includes:

25.10 : Default sudo-rs 26.10 : Coreutils 100% complete

Next target : ntpd-rs — Rust rewrite of the time-sync daemon, already in testing, planned as default in Ubuntu 27.04

Funding follows: Canonical became a Gold Sponsor of the Trifecta Tech Foundation this year, contributing €40,000 annually for memory-safe system software. This is a deliberate, long-term engineering push, not a fleeting trend.

One-Sentence Summary

Replacing cp, mv, rm with Rust implementations appears to be a "language swap" decision, but underneath the entire Linux base-software stack is re-evaluating a fundamental question: Can the hand-written C code that bought us performance thirty years ago be re-implemented more safely today without breaking anyone's scripts?

Answer: Mostly yes, but the edges need time.

For everyday users, the change is nearly invisible — a good thing. For script authors, CI engineers, and server operators, spending ten minutes checking those four traps beats debugging all night. Whether you accept the swap is up to you — the one-click rollback command is already in your hands.