Rust in the Linux Kernel at Scale: Two Years of Merge Commits Later, What the Kernel Mailing List Drama Actually Tells Us

The Numbers Tell a Story Nobody Expected

When Rust support officially landed in the Linux kernel during version 6.1 in late 2022, it arrived with roughly 13,000 lines of code. A quiet milestone. Most people in the industry treated it like a tech demo: interesting, sure, but hardly the future. Fast forward to early 2026, and we’re looking at over 600,000 lines of production Rust scattered across drivers, filesystem abstractions, and core subsystem bindings. That’s not a feature flag anymore. That’s momentum.

The velocity caught even seasoned kernel developers off guard. I’ve been in enough long-running projects to know that adoption curves this steep either indicate something genuinely useful or something driven by hype and mandate. The difference becomes apparent only when you start reading the actual merge commits, tracing dependencies, and asking why individual maintainers are voluntarily adopting the language despite significant friction. Nobody rewrites critical device drivers on a whim. They do it because the alternative starts feeling worse.

When Linus Talks About GPU Drivers, Pay Attention

In December 2025, Linus Torvalds posted on the kernel mailing list acknowledging that Rust driver contributions had accelerated notably. He specifically called out the Nova GPU driver for NVIDIA open-source firmware as the highest-profile all-Rust driver effort to date. This wasn’t a casual mention. Torvalds has spent decades building a reputation for surgical precision in his public statements about technical merit. When he highlights something, it’s usually because the implementation quality forced his hand.

The Nova driver matters because GPUs are genuinely hard. They’re concurrent, they interact directly with hardware, and they carry performance-critical code paths where the slightest misstep creates user-facing jank. An all-Rust GPU driver existing in production means the language has moved beyond device abstractions and utility code into territory where C veterans typically guard their ground most fiercely. It’s the kind of project that generates heated mailing list discussions precisely because it can’t hide behind architectural necessity alone. The implementation has to be legitimately solid.

The Security Data Actually Backs Up the Original Argument

Here’s where the mailing list drama fades into something resembling actual signal. Researchers at the University of Waterloo conducted a comprehensive analysis of 150 kernel CVEs spanning 2020 through 2024, then categorized them by vulnerability class. The findings had teeth: 67 percent of those vulnerabilities fell into memory safety categories that Rust’s ownership model structurally prevents at compile time.

Let me be specific about why this matters beyond the abstract. We’re not talking about theoretical gaps. We’re talking about use-after-free bugs, buffer overflows, data races, and other memory corruption vectors that have plagued kernel development since the beginning. These aren’t edge cases discovered by creative security researchers. They’re entire classes of bugs that appear predictably in any large C codebase operating at the scale and complexity of a modern kernel. Rust doesn’t make you a better programmer. It makes certain categories of terrible programming literally impossible to express in the language. That’s a different thing entirely, and it’s worth taking seriously even if it makes you uncomfortable.

The practical impact becomes clearer when you look at what Google’s doing with Android. Their security team reported in early 2025 that memory safety vulnerabilities across the entire OS dropped below 24 percent of total CVEs for the first time. More importantly, the proportion of new Android OS code written in memory-safe languages reached 77 percent, with Rust accounting for the majority of systems-level additions. Google Security Blog on memory safety in Android laid out the specifics. When a company operating at Google’s scale with Android’s deployment footprint starts systematically rewriting systems code in Rust, that’s not ideological commitment. That’s cost accounting. They measured the security incidents, measured the engineering cost of switching languages, and decided the equation favored the move.

The Real Tension Nobody Wants to Admit

This is where we get to the part of the mailing list drama that actually matters, and it’s frustratingly human. Ted Ts’o, one of the veteran C kernel maintainers with decades of credibility earned through shipping ext4 and other critical subsystems, posted a detailed technical critique in late 2025 arguing something that had been whispered but not publicly stated with authority: Rust’s abstraction layers were creating hidden performance regressions in I/O paths that conventional benchmarks weren’t capturing.

Ts’o’s argument wasn’t that Rust was inherently slow. That’s the cartoon version people who haven’t read the critique seem to advance. His argument was more subtle and more damaging to the cheerleader narrative. He was saying that the ergonomic abstractions Rust requires to achieve memory safety were creating compiler-generated code patterns that performed poorly in specific kernel-critical scenarios, and that benchmarks tuned to common workloads weren’t revealing the problem. It’s the kind of argument that’s impossible to dismiss out of hand because it comes from someone who has spent enough time in the relevant code to know what they’re talking about.

This is the actual conversation happening beneath the surface flame wars. Not whether Rust is good or bad. That’s too binary to be useful. The real question is whether the abstractions and ergonomics required to make Rust safe are appropriate for a particular problem domain at a particular scale. For GPU drivers and new filesystem code? Current evidence suggests yes. For core I/O scheduling primitives where microseconds compound into system-wide latency? That’s genuinely uncertain, and pretending otherwise is where credibility goes to die.

The Pragmatist’s Position

The Linux kernel has always been a pragmatist’s project. Linus didn’t adopt Rust because he fell in love with the type system. He adopted it because the case for preventing entire categories of memory corruption bugs in new code became harder to argue against than the case for maintaining linguistic consistency. That’s a practical calculation, not an ideological one. The mailing list drama reflects exactly what you’d expect when you introduce something genuinely different into a project this large: skepticism from people invested in the status quo, enthusiasm from people frustrated by the status quo, and a small group of actually competent engineers trying to figure out whether this particular tool solves problems better than alternatives.

If you’re interested in understanding how this is actually playing out at the implementation level rather than through tribal argument, Linux kernel Rust documentation provides the technical foundation. You’ll see abstractions being refined, driver patterns stabilizing, and the kind of incremental progress that suggests people are actually solving real problems rather than proving points.

The interesting part about the kernel’s Rust journey isn’t whether it wins or loses. It’s that we get to watch a large, mission-critical system decide in real time whether new tools solve genuine problems better than existing ones. The data so far suggests the answer is “sometimes, in specific contexts, with tradeoffs that matter.” Not as exciting as a definitive victory, but that’s how actual progress gets made. What aspects of this transition are you following most closely? I’m curious whether the security case or the abstraction performance tension is capturing more attention among practitioners in your circles.