Ubuntu 26.04 ships Rust sudo by default — ending a 46-year C vulnerability class

Ubuntu 26.04 LTS, released in April 2026, makes sudo-rs the default implementation of the tool that controls system-level access on Linux. When a user or process needs elevated privileges — to install software, modify system files, run a service as root — sudo is the gatekeeper. The original was written in C. sudo-rs is a complete reimplementation in Rust, and it is now the version that ships by default on the world’s most widely used Linux distribution.

The original sudo was written in 1980. In that time, the C codebase accumulated something else alongside its features: a class of memory-management vulnerabilities that Rust eliminates at the compiler level. The most significant was CVE-2021-3156, named Baron Samedit. The vulnerability sat undetected for roughly ten years, allowing local privilege escalation on every major Linux distribution. A local attacker with a non-root shell account could become root. Canonical patched it within 24 hours of disclosure. The architectural condition that allowed it — C’s manual memory management — did not get patched.

What Rust changes is not how the code is written but what class of bugs can exist in it. Buffer overflows, use-after-free errors, and null-pointer dereferences are a category of vulnerability that Rust eliminates at compile time — the compiler rejects code with these patterns before it can run. For a piece of software that handles privilege escalation, that is a significant constraint to remove from the threat model.

sudo-rs completed a full independent security audit in 2023. The project achieved performance parity with the C implementation. Canonical began shipping it as an option in earlier Ubuntu versions before making it the default in 26.04. The staged approach reflects the caution appropriate for replacing a tool that, if it fails, can either lock users out of system access or escalate attackers into root.

Ubuntu 26.04 also ships uutils coreutils — Rust rewrites of foundational tools including ls, cat, and mv. But cp, mv, and rm remain on the GNU C implementations for this release. Canonical’s rationale: TOCTOU race conditions in those Rust implementations carry risk of data destruction that the team judged too high for an LTS release. The staged rollout reveals something honest about the ‘just rewrite it in Rust’ approach: the tooling exists, but the migration requires case-by-case safety analysis, not a blanket switch.

The Linux kernel began accepting Rust driver code in 2022. The Android team has used Rust for new systems code since 2021. Microsoft has rewritten memory-sensitive Windows components in Rust. Ubuntu making sudo-rs default is a meaningful milestone because it is not an experiment in a new driver or an optional component — it is the authentication layer for system access, shipped on by default to every new Ubuntu install.

The CVE pattern that produced Baron Samedit ends for Ubuntu users under this configuration. Whether other major distributions — Debian, Red Hat, Fedora, Arch — follow the Ubuntu move to default sudo-rs is the question that determines the scale of the change. sudo-rs is available for all of them. Canonical decided the audit results were sufficient. The next decision belongs to the other maintainers.

Tags: Linux, Canonical, memory safety, Rust, sudo, Ubuntu