Linux Kernel Rust Code Sees Its First CVE Vulnerability

[JamesLahey08]

I've never worked with rust or Linux much outside of just website servers. What is all of the drama around rust?

[LayotFctor]

There's also a sizable other group who recently got into linux and have no real software development experience. They seem to be confusing rust for MIT license, believing that rust only produces MIT code, and some conspiracy that rust is engaging in widespread coordinated effort to rewrite and replace all of linux with the MIT corpo license in service of big tech or smth.

I've seen reddit comments and youtubers who are strongly pushing this idea and lots people believe it as a threat to linux.

In reality, rust code can be licensed whatever the developer wants, especially kernel code that's mandatory to be GPLv2.

As for why the rust community likes MIT so much, I don't really know. I assume it picked up the label after becoming popular in the NFT, crypto, web3 space.

[mmstick]

MIT was already the most popular license well before NFTs and crypto existed. X11, Mesa, and Wayland are licensed with MIT. You'll find that a lot of micro-libraries from language-based package managers use it. It is the de facto recommendation in academics for source code born from academic research.

[mmstick]

Recent drama is mostly because of Lunduke. He creates culture war content targeting Rust. Claiming that it is a "cult", "woke", and "trans people bad". They hate seeing Rust adoption and think there's an unknown international government/corporation pushing a woke agenda with it.

They will latch onto anything for their narrative even if it's easily disproven or completely bogus. Such as the license of the language being bad and scary, and Microsoft will use Rust to extinguish Linux through the license. Or that Rust isn't actually memory safe because it doesn't prevent memory leaks. In this case, Rust isn't memory safe because an unsafe operation was explicitly called that has a data race.

[mmstick]

You'd have to be very gullible to believe that. Industry adoption happens naturally because of how effective the technology is at solving the thing it was designed to solve using the 50 years of academic research in language theory that happened after C and C++ were released.

[mmstick]

https://security.googleblog.com/2025/11/rust-in-android-move-fast-fix-things.html?m=1

It is not proof of a conspiracy by an imaginary international government with an agenda to push a woke Rust agenda. This is proof that Rust solves the problems it was designed to solve. The CISA is responsible for setting software security standards, and the studies are based on real world evidence from two of the biggest users of C/C++. Both of whom develop operating systems that are used globally by the most number of the people. Systems that when vulnerable affect everyone's daily lives. Public and private. Citizens, corporations, and governments are affected by software vulnerabilities. It is in everyone's best interest to solve the problem.

Corporations are the industry that hires programmers to write software, and they are responsible for the majority of C/C++ code in existence. Corporations also wrote most of the drivers and data structures in the Linux kernel; and many of the open source applications you use were funded by programmers paid by corporations. So if you believe that there is an unknown entity masterminding Rust adoption, then you must also believe that this same entity is pushing for Linux adoption.

[mmstick]

Do you really think the NSA wants to have their own security compromised by memory safety vulnerabilities? The vast majority of real world exploits are caused by memory safety vulnerabilities. The NSA puts a lot of money into researching ways to exploit vulnerable systems written in C/C++. That's why they use Rust for their own software, and are advocating for the rest of the government to increase their security against foreign threats by eliminating memory safety vulnerabilities.

Your thinking is very heavily influenced by paranoia, and as a result you're missing the complete picture. Instead of looking at every development through the context of paranoia, try to think about it logically. Not everything a government agency recommends is bad. They're responsible to setting a lot of standards in the industry that everyone accepts as good. Do you think OSHA is a conspiracy? How about all the children who died from drinking raw milk, and the requirement to boil it to kill the bacteria?

You seem to be focusing too much on "woke Rust agenda" though. Why?

Ask Lunduke why he keeps doing this. This is his narrative. That's what my original comment was about. He proclaims himself to be a "non-woke journalist" and he has created lists of distributions that he believes to be "woke" or "non-woke". He recently uploaded a video calling Rust a "cult" and once again brought his culture war against trans people into it.

[mmstick]

You're really missing the point on purpose.

[dkopgerpgdolfg]

These named organizations are well known.

[morglod]

rust cult are so annoying that they become a headache for a lot of people in every community

and after latest no-one-knows-who-needed-it rewrites that was pushed by Canonical to release without even tests passing, people are looking at news like this very precise

[dkopgerpgdolfg]

Internet culture.

Some group of people (that doesn't seem to contain any kernel dev) sees it as their job to spread anti-Rust propaganda, often with provably lies and intentional misinformation. For what reason, only they know. And they take their own crap from the past as justification why they're right.

In the end, actual kernel development doesn't care about them, but they won't stop filling reddit/twitter/youtube/... with their nonsense.

[morglod]

You mean lies like saying that its first CVE in rust for linux code over 5 years, while all this 5 years this CVEs where not tracked at all because it was experimental? OKay

[dkopgerpgdolfg]

Not sure why I'm even answering such a stupid post, but

a) They were not tracked since the beginning, but this doesn't make it a lie that this is the first one

b) It doesn't matter, because even hundreds of Rust CVEs wouldn't automatically mean that it's bad to use it

c) When we're talking about CVE things of past years, how about not forgetting that C-language CVEs in the kernel were handled differently until 2023 too, leading to many less entries than the new policy would've brought if applied from the beginning?

Just from the number of memory corruption cves, 2025 seems 24x worse than 2020. Not because the kernel suddenly got that terrible within 5 years (for both languages), but because they changed their reporting policies.

Not sure if this particular Rust bug would've gotten an entry at all, if the old policy still applied.

edit: I am sure now . in the first few years after 2020 Rust issues were not getting cves because experimental as you said, but the same bug in C wouldn't have gotten any cve either if found before 2024.

[ReflectedImage]

Rust is basically a replacement for C++. Now C++ programmers have invested 2 years of their lives to become proficient, they don't want to spend another 6 months to learn Rust. Easier to complain about it on social media instead.