Big Rust rewrites of 2026

Linux, Windows, Android and Git are letting Rust in to their ecosystems. The big Rust rewrites of 2026 have reached the basic commands in the Linux terminal. From Ubuntu 26.10 cp, mv and rm run on Rust. AI agents moved Bun’s 535k lines of Zig to Rust in 11 days. GitHub ported its Copilot runtime in 3 months. Cloudflare rebuilt its proxy with performance up to 25%.

Which big Rust rewrites of 2026 are finished?

The first four rows replaced code that already worked. The last four keep their old code and add Rust beside it.

Ubuntu 26.10 finished its move to Rust coreutils

Ubuntu 26.10 runs its core utilities entirely on Rust, using the uutils project. The move took two steps. Ubuntu 25.10 switched most commands to Rust, but not all of them, and 26.04 LTS still used the GNU versions of cp, mv and rm. Ubuntu 26.10 replaced those last three with Rust.

Canonical held them back because the Rust versions still had eight open race-condition bugs ahead of the LTS. In these bugs, known as TOCTOU, a program checks a path, and an attacker swaps it before the program acts on it. A two-round audit of the Rust code by Zellic found 113 issues, and Canonical disclosed 44 CVEs in it, numbered CVE-2026-35338 through CVE-2026-35381.

rm could get around --preserve-root, the guard that stops it deleting the root filesystem. kill -1 treated its argument as process ID -1, which means every process you can reach, so a typo could end them all. A later flaw, CVE-2026-93658 in install, could leave a setuid file behind and affected uutils 0.0.18 through 0.9.x.

Still, the audit found no memory-safety bugs. What it found were logic errors the developers made during the rewrite, in how the tools handle paths, permissions, raw bytes and errors. Rust’s compiler doesn’t catch mistakes like these.

Ubuntu’s next Rust component is Sequoia PGP, which entered the main archive in 26.10. It is meant to become the default OpenPGP toolchain, with gpg still available.

Rust is still under 1% of the Linux kernel

Linux 7.0 was the first release to drop the experimental label on Rust support.

Linux 7.3 holds 120,019 lines of Rust out of 31 million, or 0.39% of the tree. More than half of that is vendored crates, so first-party kernel Rust comes to about 56,000 lines.

Some subsystems will only accept new drivers in Rust.

At Open Source Summit India, Torvalds questioned how much Rust buys the kernel.

He also thinks Rust’s guarantees end where it meets C, and he still finds C the simpler tool. Greg Kroah-Hartman took the other side at the same event, talking about the kernel’s past CVEs.

Linux fixes about 13 CVEs a day, mostly small C mistakes, though the bugs that made headlines lately were logic errors.

Is Microsoft rewriting Windows in Rust?

Partly. Microsoft has been rewriting small portions of Windows in Rust since 2023, but it has no plan to rewrite the whole system.

The main example is win32kbase_rs.sys, which holds GDI region code. It contains 177 named Rust functions and ships behind a feature flag. A teardown found Rust in just six components of a Windows 11 install, one of them third-party. Check Point found a flaw in the Rust GDI code.

The rewrite rumour started with a LinkedIn post by Microsoft engineer Galen Hunt, who set a goal of “1 engineer, 1 month, 1 million lines of code”.

Days later Hunt edited the post to say “Windows is NOT being rewritten in Rust with AI” and called the work a research project. Microsoft’s head of communications confirmed there was no plan to rewrite Windows 11 with AI.

Microsoft does use Rust on smaller jobs: DirectWriteCore’s 154,000 lines of C++ moved to Rust in about six months, and the Surface team has shipped Rust drivers.

Android shows why writing new code in Rust beats rewriting old code

Memory-safety bugs fell below 20% of Android’s vulnerabilities in 2025 for the first time. Google’s analysis ties that fall to new and actively developed code.

Google estimates about 0.2 memory-safety bugs per million lines of Rust, across roughly 5 million lines. Its historic C and C++ run at about 1,000 per million. That estimate rests on a single near miss, CVE-2025-48530, a buffer overflow in CrabbyAVIF’s unsafe Rust that was fixed before release. Safeguard’s 2026 scorecard therefore rates the 20% figure as strong evidence and the bugs-per-million figure as thin.

Medium and large Rust changes get rolled back about four times less often than C++ ones, and Rust changes spend 25% less time in code review. Rust now reaches firmware, the kernel and first-party apps. Kroah-Hartman says the C version of Binder, the kernel’s messaging driver for Android, will go away soon, leaving only the Rust one.

Cloudflare replaced its proxy and took on a TypeScript port

Cloudflare is the only company here running a rewrite under a large share of web traffic. FL2 is a complete Rust rewrite of its request layer, replacing 15 years of NGINX and LuaJIT code. The new proxy cut median response time by 10 ms and raised performance 25%. It also uses less than half the CPU the old proxy needed.

Cloudflare moved to Rust because of Cloudbleed, a memory bug that leaked data from its servers in 2017.

The move isn’t finished. According to Sylvain Kerkour, the old proxy is still being phased out, and the HTTP and TLS layer still runs on NGINX while Cloudflare rewrites it.

Rust did not stop Cloudflare’s November 2025 outage. An oversized config file hit a hard limit, and an unwrap() in FL2 panicked on the error.

In a separate project, Cloudflare and VoidZero published tsrs, a Rust port of the TypeScript compiler. They claim up to 8x the speed of TypeScript 7.0 and about 70% less memory. Go, the language of TypeScript 7.0, lost out because it must bundle its garbage collector when compiled to WebAssembly.

One outside run measured tsrs at about 4 to 5 times the speed of the 7.1 beta on equal threads, but some of its error messages still differed from TypeScript’s. A second test, by a dev.to writer, put it closer to 3x.

Cloudflare also says tsrs is no fork. The port has to follow the TypeScript team’s design decisions closely, or it will drift into incompatibility.

Git will require Rust in version 3.0

Git is staying in C for now, but from version 3.0 you’ll need a Rust compiler to build it. Git developer Patrick Steinhardt planned a gradual change: Rust starts as an optional part of the build and becomes mandatory in 3.0. The first conversion was tiny, just the varint subsystem as a proof of concept.

Git 2.55 turned Rust on by default with an opt-out, and 3.0 removes that opt-out. No release date is set. That default has already broken builds: the devcontainers Git feature failed on images without a Rust toolchain until it set NO_RUST=YesPlease.

The cost lands on small platforms, because Rust does not run everywhere Git does.

Bun and GitHub let AI agents do 2026’s biggest Rust rewrites

The two largest finished ports of the year were mostly agent work, in opposite styles. Anthropic owns Bun, and Bun’s port used Claude.

Bun went all at once. No tests were skipped or deleted, binaries shrank about 20% on Linux and Windows, and server throughput rose 4.8%. Memory after 2,000 builds fell from 6,745 MB to 609 MB. About 4% of the Rust lives in unsafe blocks, and 19 regressions from the port had to be fixed.

GitHub’s Copilot runtime went one component at a time, with main always shippable. In GitHub’s measured test, starting a client, creating a session and running one turn dropped from 5.25 s to 292 ms with Rust embedded in-process, and each SDK client no longer needs about 100 MB of Node.js. GitHub wanted to embed the runtime through a C ABI, a reason most large TypeScript programs don’t share.

Stephen Toub led the work and wrote about 2,600 messages reviewing and challenging the agents.

Both projects tested against something that already existed: Bun had a test suite written in TypeScript, and GitHub had live behaviour on main.

Can you rewrite your own project in Rust with AI agents?

Yes, if you have a way to prove the port works. Individuals now finish ports that once took teams a year:

• Christopher Chedeau ported about 100,000 lines of Pokémon Showdown from TypeScript in a month with Claude Code, and wrote no code himself.
• Theo Browne ported the TypeScript compiler for about $24,000 in tokens to see if it could be done. An earlier try with other models burned over $400,000 and stalled near 84% compatibility.
• Andreas Kling moved 25,000 lines of Ladybird’s JavaScript engine in two weeks, with zero regressions across 52,898 test262 tests.
• David Turvene converted a small C state machine with Claude Code without knowing Rust well, which is the realistic starting point for most people.

The ports that worked share a few habits:

• Build a truth test first. Chedeau compared old and new output on seeded random battles, and about 80 of the first 2.4 million still differed.
• Port mechanically, tidy later. Kling kept the Rust deliberately non-idiomatic at first. Chedeau’s early one-shot attempt failed on shortcuts and wrong abstractions.
• Keep pieces small. Chedeau split every method into its own file so the agent could hold its context.
• Expect shortcuts. Agents hardcode behaviour, write “simplified” versions and dodge hard tasks.

Kling stresses that a person stayed in charge.

The chardet 7.0 rewrite used AI help to move the library from LGPL to MIT, and the original author objected. Heather Meeker has laid out the legal questions.

In Browne’s port, Claude worked from Microsoft’s Go version of the compiler in place of the original JavaScript and copied some of its bugs, and Browne has not inspected the result.

Will Rust become the dominant language of the next decades?

Probably for new low-level code. Android’s new code is moving to Rust, some Linux subsystems will only accept new Rust drivers, and Git will need a Rust compiler from 3.0.

Old code will take much longer, since Rust is still under 1% of Linux’s 31 million lines. AI agents could speed that up if bigger projects can match Bun’s 11 days and GitHub’s 14.5 weeks. But Ubuntu’s 44 CVEs show that a rewrite can bring in new logic bugs.

My bet is that C, and then C++, will still be in use decades from now, but mostly in code that is no longer actively developed. COBOL went the same way, becoming an ancient technology that only large legacy systems, like banking, could not get rid of. I think AI will make it easier to switch, and new code will for sure get written in Rust. Even banking will do it at some point.