Rust for Linux kernel code: what memory safety removes, and what it costs

Is Rust in the Linux kernel, and why use it there?#

Yes: Rust is a permanent second language of the Linux kernel, merged in Linux 6.1 as Kernel Newbies lists for 11 December 2022, because it removes memory-safety bugs at compile time.

Kernel Newbies' Linux 6.1 notes say Rust gives memory safety without a garbage collector, "eliminating an entire class of bugs". Then the first Rust drivers followed in 6.8, as LWN.net's report on the 6.8 merge window, of 12 January 2024, records. In a mailing list reply of December 2025, the maintainers closed the trial: "the experiment is done, i.e. Rust is here to stay".

Linux is still not a Rust based kernel, though: it is a C kernel that now takes Rust code beside its C. So a team no longer asks whether Rust belongs in the kernel. Instead, it asks whether the next driver should be written in it.

What does a team gain from writing kernel code in Rust?#

Google's Android Security team counts 25% less time in code review and 20% fewer revisions for Rust changes than comparable C++ changes, in its 13 November 2025 post.

That Android security post puts it in one line: "the safer path is now also the faster one". In practice, a lead can report this upward as delivery speed, not only as security. Because rework is a slow part of review, fewer revisions shorten the queue for everyone. Still, Google adds a caveat: part of the gain may come from growing Rust skill on its own team.

Which memory-safety bugs does Rust remove from kernel code?#

Google's Android Security team estimates 0.2 memory-safety vulnerabilities per million lines of Rust against about 1,000 for its C and C++ code, in its 13 November 2025 post.

That is a gap of three orders of magnitude, and the compiler makes it. Ownership and borrow checking reject use-after-free, double-free and out-of-bounds access before the code runs. Since this bug class is so common, the gap matters. For example, the Chromium security page, read in October 2026, finds that around 70% of its serious security bugs are memory-safety problems.

In the kernel, the guarantee comes through layers. The general information page says bindings declare the C functions for Rust, and abstractions are Rust code that wraps them. So drivers use the abstractions, not the C bindings directly.

Does unsafe Rust put the memory bugs back?#

Google's Android Security team counts about 4% of its Rust code inside unsafe blocks, and memory-safety bugs fell below 20% of Android vulnerabilities in 2025, per its 13 November 2025 post.

Still, an operating system cannot ban unsafe code. Google's post names the reasons: talking to hardware and calling across the C boundary. So the kernel contains that surface instead. Its coding guidelines require a // SAFETY: comment before every unsafe block, saying why the code inside is sound. As a result, every manual memory step carries a written reason that review can check.

Even so, Google reports one near miss in unsafe Rust, found and fixed before release. The leftover risk is small, but it is real.

Do Rust changes break less often than C++ changes?#

Google's Android Security team counts a rollback rate about 4 times lower for medium and large Rust changes than for C++, in its 13 November 2025 post.

But a rollback is never just one bug. Google's post lists what follows it: rework, more reviews, build respins, postmortems and blocked teams. Therefore a lower rollback rate is a running cost removed, and it goes on Rust's side beside the bug count.

What does Rust for Linux kernel code cost in speed and energy?#

A 2025 TU Wien thesis by Garber measured a Rust GPIO driver 8% to 14.3% slower and using 27.68% to 46.15% more energy than its C version on a Raspberry Pi 4.

GPIO means general purpose input and output, the pins a board uses to drive simple hardware. The TU Wien thesis built three variants of a virtual GPIO driver. In Garber's 2025 results, the basic Rust variant ran 8% slower and drew 46.15% more energy. With a wait queue, it ran 11% slower for 27.68% more. With a wait queue and a spinlock, it ran 14.3% slower for 33.86% more.

This is one driver on one board, so it is not a law. However, it shows that the carbon cost of memory safety must be measured per driver, never assumed to be zero. So sustainability with Rust is a measurement per driver, not a slogan. Also, the thesis argues Rust may still be worth it, because debugging is easier and quicker than in C.

How many memory bugs would your next driver carry?#

In a worked example, an assumed 50,000-line driver carries about 50 memory-safety bugs at the C and C++ density and 0.01 at the Rust density Google published on 13 November 2025.

First, divide the lines of new code by one million, then multiply by each density. Google's two 2025 densities are 1,000 and 0.2 per million lines. So an assumed 10,000-line driver expects about 10 bugs in C and 0.002 in Rust. Likewise, an assumed 100,000-line driver expects about 100 and 0.02. Because these are Android averages, not kernel counts, read them as a ratio rather than a forecast.

Then set that count against the measured premium. If one memory bug costs you more than a slower, hungrier hot path, Rust wins.

Which drivers are already written in Rust?#

LWN.net lists the Android binder driver merged for Linux 6.18 and Android 16 devices shipping a Rust ashmem module on kernel 6.12, as of 13 December 2025.

Binder is Android's messaging driver between processes, and ashmem is its shared memory allocator. LWN.net's December 2025 report adds that pieces of the Nova driver for NVIDIA GPUs are merged. It also says Rust code in the kernel grew by a factor of five in a year. Meanwhile, Wikipedia's list names the Apple silicon AGX GPU driver from Asahi Linux, a network PHY driver and an NVMe driver.

For these teams, the sum already came out in Rust's favour. So the open question is your driver, not the language.

Which kernel pages and Rust version do you build from?#

The Rust for Linux project lists Rust 1.85.0 as the kernel's minimum compiler today, up from 1.78.0 when Linux v6.11 first set a floor, as of October 2026.

Read these four pages in order:

1. Rust for Linux's version policy: the minimum compiler, and why it now follows Debian Stable's Rust version.
2. The kernel's quick-start page: installing rustc (the Rust compiler) and bindgen (the tool that writes the C bindings), then the rustavailable check.
3. Its general information page: how abstractions wrap the C bindings.
4. Its coding guidelines: // SAFETY: comments and rustfmt formatting.

Stable kernels can differ, though. In October 2026 the same policy page notes that Linux 6.18.y still needs only Rust 1.78.0.

What is the smallest Rust kernel setup that builds?#

The smallest working setup is three steps: check the toolchain with make LLVM=1 rustavailable, enable CONFIG_RUST, then build the Rust samples.

First, run these from the top of a kernel source tree. Step two happens in your usual kernel configuration tool, since the option only appears once the toolchain check passes.

# 1. Check that a suitable Rust toolchain is found
make LLVM=1 rustavailable

# 2. In the kernel configuration, enable Rust support (CONFIG_RUST)
#    under General setup, then enable a sample under
#    Kernel hacking > Sample kernel code > Rust samples

# 3. Build with the full LLVM toolchain
make LLVM=1

# 4. Check formatting before you send a patch
make LLVM=1 rustfmtcheck

Then the coding guidelines add one rule for review. Every unsafe block carries its reason directly above it:

// SAFETY: `p` is valid by the safety requirements.
unsafe { *p = 0; }

Finally, read the samples under samples/rust/ beside the support code under rust/, as the quick-start page suggests.

When is Rust the wrong tool for kernel work?#

Rust is the wrong tool for rewriting stable C that already works, or for an architecture outside the well-supported set that LWN.net reported on 13 December 2025.

When NOT to use this, three cases favour staying in C:

• A stable C driver with no memory-safety history. A rewrite adds risk and buys little. Instead, write the next new driver in Rust.
• An architecture without good Rust support. LWN.net lists good support for x86, Arm, Loongarch, RISC-V and user-mode Linux. Elsewhere, keep C until support lands.
• A hot path where speed matters most. If the TU Wien 2025 slowdown of 8% to 14.3% would outweigh the bug class, measure your own driver first.

Even so, the joint CISA and NSA guidance of 24 June 2025 calls memory-safe languages "the most comprehensive mitigation against this class of vulnerabilities". So the exit is about timing and fit, not the language.

Where does the memory-safety ledger go from here?#

The decision stays open: measure your own driver's overhead, count its expected bugs, and revisit as the kernel's Rust floor and driver list move.

For the energy side, the low-carbon design theme post applies the same cost thinking to the web. For work that moves closer to the hardware, see computational storage and eBPF. Also, why CPU cache beats RAM shows where small overheads hide. And the top AI programming languages places Rust beside its peers. Our sustainable development and security and compliance pages describe related work. But the kernel's own documentation is enough to start on your own.