Forgot your password?
typodupeerror
AI Privacy Programming Security Linux

Rust Will Save Linux From AI, Says Greg Kroah-Hartman 168

Linux stable kernel maintainer Greg Kroah-Hartman says Rust can help Linux deal with a flood of AI-discovered security bugs (namely Dirty Frag, Copy Fail, and Fragnesia) by preventing common C mistakes around memory, locking, error handling, and untrusted data at build time rather than during human review. It's "not a silver bullet" and does not mean rewriting the whole kernel, but he said new drivers and subsystems will increasingly use Rust as Linux evolves forward. ZDNet reports: Kroah-Hartman illustrated those pitfalls with real C bugs in the kernel, including a 15-year-old Bluetooth bug that dereferenced a pointer without checking it and a Xen bug where "we forgot to unlock" in an error path. "The majority of the bugs in the kernel are this tiny, minor stuff," he explained. "Error conditions aren't checked, locks aren't forgotten, unreleased memories leak, and vulnerabilities add up over time. They crash the kernel. This is what we live with in C. This is why we don't like it." Kroah-Hartman argued that the "best beauty of Rust" is catching those mistakes at build time rather than in review. For example, when it comes to locking, he highlighted Rust's locking abstractions in the kernel: "The only way you can get access to inner pointers of structures is by grabbing that lock, and releasing the lock automatically. The compiler does it, it's guarded, the lock happens, everything's happy. You just can't write code to access these values...without grabbing the lock. The compiler will not let you."

Those properties, he argued, directly remove a huge fraction of the bugs he sees: "This is going to save us those two things. First, 60% of the bugs in the kernel right there, they're gone. Thank you." The payoff is earlier, more automated enforcement: "If this happens at build time, not review time, don't make me a maintainer who has to read your code [and] say, 'Oh, then you properly check that error value. Oh, did you properly grab the locks in the right spot?' Rust gives us that for free. This is the best thing ever." Even if Rust vanished tomorrow, Kroah-Hartman argued, it has already forced the kernel to clean up C code and interfaces. He credited Rust's influence outright: "We stole this from Rust. Thank you. It's a good idea, so if Rust disappeared tomorrow, we have cleaned up the C code in the kernel so much and taken in the ideas. We thank you, you've made Linux better with it just by existing."

[...] What ultimately sold a number of core maintainers, including him, on Rust was how it "makes reviewing code easier." With CI [Continuous Integration] bots enforcing builds and Rust's type system enforcing key invariants, maintainers can "focus on the logic" rather than resource bookkeeping: "I can care about that one function. I don't have to worry about the rest of this stuff, because I assume that it works properly, because it was built properly." Internally, he said, the top maintainers have already made their call on Rust's status: "The Linux kernel maintainers, we get together every year and talk about what the processes are doing. Last year, we said the Rust experiment is over. It's not an experiment. This is for real." The rationale: "The people behind it are real. We trust them. We know what they're doing. They've shown and put in the work to make Rust a viable language in the kernel, and we're going to make this stick. Let's go full speed ahead. And, as always," he said wryly, "world domination proceeds."
"If you never remember anything else in my talk, just remember these four words. It came from Microsoft Security many, many years ago," Kroah-Hartman told attendees. "They realized all input is evil. You have to validate all input."

Rust Will Save Linux From AI, Says Greg Kroah-Hartman

Comments Filter:
  • Wait, 4 words? (Score:4, Insightful)

    by mackil ( 668039 ) <movie AT moviesoundclips DOT net> on Wednesday May 27, 2026 @05:20PM (#66163198) Homepage Journal

    "If you never remember anything else in my talk, just remember these four words. It came from Microsoft Security many, many years ago," Kroah-Hartman told attendees. "They realized all input is evil. You have to validate all input."

    Which four words are we supposed to remember?

  • by dfghjk ( 711126 ) on Wednesday May 27, 2026 @05:21PM (#66163200)

    "This is what we live with in C. This is why we don't like it."

    It is not, it's what is lived with in a codebase, C has nothing to do with it. Also, there is nothing about an approach mandated by one language that cannot be implemented in C, Rust creators have not made anything that kernel developers cannot otherwise do.

    It is sad what programmers have become that cause claims like this to be made.

    "With CI [Continuous Integration] bots enforcing builds ..."

    The battle is already lost.

    "They realized all input is evil. You have to validate all input."

    No. Depends on where the input comes from. Hard to have respect for this guy, regardless of what he is alleged to do.

    • by haruchai ( 17472 )

      "what he is alleged to do"
      WTF? that's like saying Linux is "alleged" to have been named after Linus Torvalds

    • Re: (Score:3, Insightful)

      by swillden ( 191260 )

      It is not, it's what is lived with in a codebase, C has nothing to do with it. Also, there is nothing about an approach mandated by one language that cannot be implemented in C, Rust creators have not made anything that kernel developers cannot otherwise do.

      C has everything to do with it. C requires that programmers be infallible. They're not. They never have been. They never will be.

      Rust's designers understand that programmers are human and will always make mistakes so the language allows and even requires building safe zero-cost abstractions that allow the compiler to check for huge swathes of common mistakes. Rust isn't the first language to do that, by any means, but it's the first language that (a) does it consistently and thoroughly (C++ fails this

      • by phantomfive ( 622387 ) on Wednesday May 27, 2026 @06:17PM (#66163290) Journal
        He sucks.

        The reason is that even though he has been programming in C for 20 years or more in the kernel, he never sat down and asked himself, "How do I avoid memory bugs in C? How do I avoid bugs?" It wasn't until he started using Rust that he even began approaching that question.

        So his code is going to have plenty of other bugs, simply because he's never asked himself the question, "How do I avoid bugs?" No language is going to save him.
        • by Jeremi ( 14640 ) on Wednesday May 27, 2026 @08:04PM (#66163432) Homepage

          You know what improves code quality? Process improvements.

          You know what doesn't improve code quality? Telling people that they suck. It's pointless and immature.

          • You know what matters? Facts, not feelings.
            • by DamnOregonian ( 963763 ) on Thursday May 28, 2026 @12:30AM (#66163616)
              Then I hope yours won't be hurt by this little factoid- you're a fucking moron.

              As someone who has had several 5-minutes-of-fame CVEs attributed to me, I can assure you that all programmers suck, particularly those wielding C. You're no exception. Neither am I. Despite 20 years of experience, and many hundreds of thousands of lines of C to my name doing work right now around the world.

              I'm far from a Rust fanboi- I find the syntax revolting. I know a lot of that is personal taste, and that I'm old, and that's not going to change.
              All that being said, it's simply undeniable that all code is going to have bugs, and a language that makes certain classes of bugs impossible is going to have less.

              Remember, what matters are facts- not feelings.
            • The OP was giving you facts.

              In other domains when performs keep happening, the solution is process improvements, to mitigate the fallibility of humans.

              Programming isn't special here and neither are programmes. We don't yell at pilots that they suck, we now have extensive process improvements and planes are pretty safe. In much of Europe, if a road is dangerous, we generally try and fix the road to be less safe, not the road users which is why much of Europe has much safer roads than America which does not f

              • Alright then. How is your team's bug tracker? If it's not empty (or count on a decreasing trajectory), maybe you should go yell at your team more.
              • Also, don't tell me about European roads. I've seen [baltic-course.com] the pictures [driveeurope.co.uk].
                • It is very typical of an American to pick the worst instance of anything they can find in order to prove they're better than the very worst thing you can find! Good for you!

                  Meanwhile you have roads that are more dangerous than anything in Western Europe. I look forward to your excuses as to why this is the case.

                • by SirSlud ( 67381 )

                  "I've seen the pictures" says another American who figures using the internet amounts to actually living life, going places, being less of a moron.

        • by haruchai ( 17472 )

          While he's written a fair bit of code, he's mostly been a maintainer for a long time.
          There are ~5000 Linux kernel devs representing over 300 corporations.
          Do they all suck as much as GKH? Then why would anyone adopt Linux?
          Hint: Linux world domination happened quite some time ago.

          • Do they all suck as much as GKH?

            No, they don't. Some are worse. Some are better.

            • by haruchai ( 17472 )

              Some are worse. Some are better.

              That's applies to everyone, in every field.
              GK-H has been deeply involved with Linux kernel development for TWENTY years.
              If he sucks so much then so does Linux sucks and i would think you must scrupulously avoid using it in all circumstances.

        • he never sat down and asked himself, "How do I avoid memory bugs in C? How do I avoid bugs?"

          Of course he asked himself those questions. The problem is that the answer is "I can't. I can do some things to try to reduce their occurrence, but C is fundamentally not designed to make avoiding them possible".

    • The car industry went through something similar seemingly ages ago. The Japanese (Toyota mostly) aligned processes such that average or even mediocre operators would result in quality cars. The American and European car industries traditionally based their setup on highly qualified people with a brain and brilliant people developing things. When they realised they couldn't scale and had trouble finding highly qualified people, they tried to solve things by going on the hunt for more brilliant engineers.

      Fa

    • Rust has added a process which makes the language handle the bit humans are really bad at handling. The bit where even the most excellent programmer makes easy to miss mistakes just by having a bad day. This process can't be implemented in C.

      It's sad what the peanut gallery has become that cause claims like this to be made.

      And yes. All input is evil. Exactly all. No exceptions.

      • by DarkOx ( 621550 )

        This process can't be implemented in C.

        Bullshit, all the memory safety could be implemented with some set of factory and clean up functions that are always the 'owners'. All the bounds checking could be implemented with some macro version/replacements of C's control flow constructs.

        There is literally nothing stopping you from doing everything RUST does in plain C, except for the fact it would result in a confusing syntax and nobody would want to work on your project.

        Ditto you could certainly build just about all of C++ in C as well, in fact the

        • This process can't be implemented in C.

          Bullshit, all the memory safety could be implemented with some set of factory and clean up functions that are always the 'owners'. All the bounds checking could be implemented with some macro version/replacements of C's control flow constructs.

          Ah, the "Of course we can do this if only programmers always remember to do X, Y and Z" argument.

          This is exactly the point. Rust encodes those safe practices into the language and has the compiler enforce them. No one is arguing that it's not possible to write safe, correct C code. Only that humans are incapable of doing it at scale.

        • by kertaamo ( 16100 )

          This is simply not true. You cannot write C in such a way to perform all the memory safety and type checks that Rust does at compile time. That would require changing the C syntax and semantics. Fine idea, but if you do that then that new language will not be C any more and it will likely look like Rust.

    • It is not, it's what is lived with in a codebase, C has nothing to do with it. Also, there is nothing about an approach mandated by one language that cannot be implemented in C, Rust creators have not made anything that kernel developers cannot otherwise do.

      Broadly speaking, no this isn't correct.

      From a very narrow perspective there's some truth: C is Turing complete so you can do anything in it you can do in another language. But that's also an argument in favour of writing the kernel brainfuck, Malboge or

      • I can't remember the last time I encountered a commercial project in C other than tiny firmware.

        I'm even seeing tiny firmware moving to Rust. no_std noalloc Rust is actually a pretty good fit for that environment, especially since a lot of tiny firmware code absolutely, positively must not crash, ever. Rust's memory safety plus the no-panic crate get you about as close to that as possible without formal methods. The biggest remaining gap is stack overflow. flip-link is a pretty good tool for that; it doesn't keep you from blowing the stack, but it makes stack overflows a hard, immediate crash rath

  • by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Wednesday May 27, 2026 @05:22PM (#66163204) Homepage Journal

    If you've got the AI tools to tell you how you screwed up with C, why do you need Rust? Just fix what the LLM says you broke. Now you have the speed of C without the bugs. It ought to be easy to find that class of error, right?

    • by caseih ( 160668 ) on Wednesday May 27, 2026 @05:49PM (#66163236)

      Better yet, the LLM can just write the secure C code in the first place.

      If Mythos is so great, why not close the loop?

      • If we're going to appeal to religion, we might as well pray for it to write us a linter to solve this problem once and for all.

    • by Himmy32 ( 650060 )

      The problem is that time between the AI tool discovering a bug and the release of the patch, there's a bunch of panicked work by the developers and a time where the vulnerability is exploitable without an available patch. So if they can avoid several classes of errors and those are most of what the AI are finding, there's a bunch of work saved.

      If it was just the developers using the AI tools though and the patch notes weren't open, then you'd more correct.

    • For existing code in the QA he said leave it be and it's better to fix.

      For new code, he's recommending Rust and the advantage he talks about is that it makes the code more maintainable by people. And one thing that every AI coding talk I've seen agrees on is that what makes code more maintainable by people also helps AI and vice versa.

      People and AI both have limited attention and memory. The less context necessary the easier it is to evaluate safety.

      Another thing not in the summary he touches on is hardwa

    • by Jeremi ( 14640 )

      If you have access to a God-tier LLM that you can rely on to find every bug, I think that could work.

      However, I don't think anyone in the Linux community is ready to trust LLMs to that extent just yet. Not only are they quite fallible, they are also non-deterministic -- so if you ask your favorite LLM to find the bugs in the code, and it doesn't find any, and then you feed it the exact same prompt again, it might find some on its second attempt. So how do you know when to stop re-asking?

      LLMs are currently

      • by jezwel ( 2451108 )

        So how do you know when to stop re-asking?

        Why did the Irishman run a bug-checking LLM over his code before release?

        To be sure
        To be sure
        To be sure

        If it's still getting inconsistent results when run multiple times over the same code, the LLM needs more work.

    • âoeThe car wash to raise money for the bake sale has been canceled due to confusionâ

    • by Bahbus ( 1180627 )

      Why have an LLM tell you it thinks you fucked up when you can have the compiler not allow you to make the fuck up in the first place?

    • by haruchai ( 17472 )

      if any of the other programming languages were good enough, the Law of Rustification would not exist.
      that said, Zig apparently is showing great potential as a Rust alternative but still some way distant from a 1.0 release

  • by im_thatoneguy ( 819432 ) on Wednesday May 27, 2026 @06:15PM (#66163288)

    To balance out OP's selective quoting to avoid people strawman-ing his argument as a fanatic who can't balance risk:

    "No, we don't want [rust] rewrites, so unless you're the maintainer and owner of that file, just do it for new stuff. Leave existing C code alone, and let's evolve forward after that."

    Now, that doesn't mean he thinks Rust is magic. It's not. He cited one of the first Rust components merged into the kernel: QR code display logic used when the kernel crashes. "That logic was written in Rust. Famously, it had a memory bug. It was given a buffer and its size, and the rest of the st code never checked the buffer size... Could scribble all over memory..."

  • "AI will save Linux from Rust"

  • After doing some heavy low-level C coding for many years, I recently decided to look at Rust and see what it's all about. It really is a huge improvement over C.

    With C, you need to understand the capabilities of the hardware and low-level operating system features. Shared memory, locks, semaphores, basic memory management, and, of course, pointers for everything.

    With Rust, a deeper understanding of how the OS works really helps. The heap and stack for function calls and passing parameters, concurrency, a

    • C has evolved. but not enough. too much resistance.

      What Rust needs to do is pressure C to evolve features that negate the need for Rust. AI can make the compiler smarter if you limit it's reach so it's not generating code and replacing compiling. The fact C is so stubborn that it is under real threat of becoming irrelevant and only an entrenched legacy language is a bad sign. Cobal on the other hand, has a stronger case for being relevant but it's been pushed out so it's not like rationality is what guides

    • With C, you need to understand the capabilities of the hardware and low-level operating system features. Shared memory, locks, semaphores, basic memory management, and, of course, pointers for everything.

      So you need to have a computer science degree?

  • by thesjaakspoiler ( 4782965 ) on Wednesday May 27, 2026 @08:15PM (#66163444)

    We should allow for programming languages to be awarded the Nobel Peace Price.
    If Henry Kissinger can get a Nobel Peace Price, Rust should also be able to get one because everything is better with Rust.
    I'd wish that someone would have pointer out that Visual Basic doesn't have pointers so we could have had Linux kernel support for it.

    • Fun fact: On Windows you can in fact write kernel drivers in Visual Basic. (Classic, obviously .NET managed code won't work. And the original compiler can't target x64 so for that you need the twinBASIC compiler, which is backwards compatible for VB6 code, since there's no WOW64 in the kernel).
  • cURL and libcurl, solid tools that recently withstood AI-driven exploit research, are written in C. Rust is not a cure-all for every problem.
  • I can't believe Rust and AI were mentioned in the same article and Slashdot didn't go down. I only see about 50 or so, "not on my lawn", "damn kids messing with technology, nothing wrong with the old ways" comments.

  • (big) if, but if AI can detect all the problems possible in C code that Rust might avoid, would that not make Rust the obsolete product? Just use C and let AI highlight all the memory problems - and you fix it right there instead of learning/installing Rust.
  • The kernel is what, 3% rust, 98% C?
    It's still 0% Zig so that's not great.

    • by PCM2 ( 4486 )

      It's still 0% Zig so that's not great.

      Minimal justice, if we want to split hairs.

Everything should be made as simple as possible, but not simpler. -- Albert Einstein

Working...