The Scale Shift Nobody Expected (Except Everyone Who Was Paying Attention)
When Rust support officially merged into the Linux kernel in late 2022 with version 6.1, the tree contained roughly 13,000 lines of Rust code. I remember the mood on the kernel mailing list felt like cautious optimism mixed with academic curiosity. “Fine, let’s try this,” seemed to be the consensus. “But it better not break anything.” Fast forward to early 2026, and we are looking at over 600,000 lines of Rust across drivers, filesystem abstractions, and core subsystem bindings. That is not a gradual adoption curve. That is a phase transition.
What strikes me most about this trajectory is what it represents operationally. You do not go from 13,000 to 600,000 lines of code in a production-critical system without something fundamental shifting in how maintainers and contributors view the tradeoff between safety guarantees and implementation friction. The cynical interpretation is that Rust advocates finally won the political battle. The honest interpretation is messier and more interesting: the kernel community collectively realized that memory safety bugs were eating their lunch, and Rust was the least terrible solution available.
When Your GPU Driver Lives in Rust
The watershed moment came with NVIDIA’s Nova GPU driver initiative. Linus Torvalds confirmed in a December 2025 kernel mailing list post that Rust driver contributions have accelerated significantly, with Nova representing the highest-profile all-Rust driver effort to date. Let me be direct: getting a GPU driver merged into the mainline kernel is already a production-readiness marathon under the best circumstances. Getting one written entirely in Rust past skeptical reviewers required technical excellence that could not be hand-waved away.
What Nova proved was not just that you could write complex device drivers in Rust. It proved that the abstractions the kernel community had developed over three years were solid enough to handle something genuinely hard. I spent a weekend reading through the Nova submission threads, and the technical feedback was real. People were not rubber-stamping it because it was Rust. They were engaging with the actual design decisions. That is how you know a technology has stopped being a religious argument and started being a tool.
The Numbers Started Talking, and They Were Loud
Here is where the conversation shifted from philosophy to pragmatism. A 2025 study from the University of Waterloo analyzing 150 kernel CVEs from 2020-2024 found that 67 percent fell into memory safety categories that Rust’s ownership model structurally prevents. Seventy years of C, and it turns out that a significant majority of security vulnerabilities in the kernel trace back to problems that Rust simply does not allow you to create in the first place. You cannot have a use-after-free bug in Rust code. You cannot have a buffer overflow through naive indexing. The language does not let you.
This is not theoretical. This is not “Rust is safer if you follow best practices.” This is structural. The compiler refuses. For kernel developers accustomed to defensive programming as a way of life, that shift registers differently when you see it backed by empirical analysis of real CVEs.
Google’s Android team reported in a 2025 blog post that the proportion of new Android OS code written in memory-safe languages reached 77 percent, with Rust accounting for the majority of systems-level additions. More importantly, memory safety vulnerabilities in Android dropped to below 24 percent of total CVEs for the first time. You can argue about correlation and causation all you like, but when a platform that ships on billions of devices shows that metric, people listen. Check their Google Security Blog on memory safety in Android for the full breakdown. The data is public.
The Abstractions Tax Started Coming Due
Now here is where I have to put on my honest face and acknowledge that nothing in systems programming is free. In late 2025, veteran C maintainer Ted Ts’o posted a detailed technical critique arguing that Rust’s abstraction layers were creating hidden performance regressions in I/O paths that benchmarks were not capturing. And he was not wrong. He was not being a Luddite. He was being precise.
The argument goes like this: Rust’s abstractions force certain patterns. Those patterns are safe, yes. But safe is not free. Compiler optimizations have to work harder. The abstraction boundaries do not always align perfectly with hardware realities. When you are talking about code paths that execute billions of times per second across millions of servers, a small hidden cost becomes audible.
This critique mattered because it shifted the conversation away from “Rust versus C as an ideology” into “where do these abstraction costs actually manifest, and are they worth the safety gains?” That is a conversation you can have empirically, where you can measure things. The kernel mailing list threads that followed were dense, technical, and remarkably civil by historical standards. People were arguing about specific performance profiles, not about whether Rust belonged in the kernel. That is progress.
What This Actually Tells Us
Looking back from 2026 at the landscape that has emerged over two years of merge cycles, a few things become clear. First, the Rust transition in the kernel is real and accelerating, but it is not displacing C wholesale. It is expanding into new problem domains where the safety guarantees justify the abstraction costs. That is the sustainable path.
Second, the technical community has genuinely grappled with the tradeoffs instead of retreating into tribal signaling. Yes, there was drama on the mailing list. Kernel development drama is not new. But the drama has been the friction of genuinely difficult engineering questions, not ideology. When I read threads about Rust abstractions and I/O performance, I am reading the same careful reasoning I would see in threads about CPU cache behavior or network stack optimization. That normalization is the most important signal.
Third, and perhaps most importantly: when you have empirical data showing that 67 percent of kernel CVEs trace to problems Rust structurally prevents, and you have a platform like Android showing real-world security improvements, you have crossed a threshold where the burden of proof flips. The question is no longer “why Rust?” It becomes “why not Rust, in this particular context?” That shift is irreversible.
For anyone still following this evolution, the practical takeaway is to stop viewing Rust in the kernel as a binary choice. Check out the Linux kernel Rust documentation and understand where it is actually deployed and why. The drama you see on the mailing list is not a sign of failure. It is a sign of a community taking difficult engineering seriously.
What has your experience been with Rust in production systems? Have you hit those abstraction costs Ted Ts’o identified, or do your workloads sit in the “safety wins” category? The conversation is far from over, and I am genuinely curious what practitioners are seeing on the ground.
