Ubuntu 26.10 Ships 100% Rust Coreutils; Audit Found 44 CVEs Beyond Rust's Scope

Ubuntu 26.10 becomes the first major Linux distro to ship 100% memory-safe coreutils in Rust by default. A Zellic audit found 44 CVEs that Rust's type system cannot prevent, requiring kernel-level file-descriptor fixes for TOCTOU race conditions. Beta lands September 24; stable arrives October 15, 2026.

• Ubuntu 26.10 is the first major distro with Rust coreutils by default
• Zellic audit found 44 CVEs beyond Rust's type system
• TOCTOU races need kernel-level file-descriptor fixes
• Beta on September 24, stable release on October 15, 2026