Rust in the Linux Kernel at Scale: Two Years of Merge Commits Later, What the Kernel Mailing List Drama Actually Tells Us

The Numbers Don’t Lie, But They Hide Complexity

When Rust support landed in Linux kernel 6.1 back in late 2022, the codebase contained roughly 13,000 lines of Rust code. Today, in early 2026, that number has climbed past 600,000 lines across drivers, filesystem abstractions, and core subsystem bindings. That’s a 46-fold increase in less than three and a half years. On the surface, this looks like a validation story: the kernel is adopting memory safety, and adoption is accelerating. Dig deeper, and you realize the actual narrative is messier, more contested, and ultimately more interesting than any simple validation or rejection would allow.

The growth rate tells you something real happened. It tells you that Linus Torvalds’ decision to accept Rust into the kernel wasn’t merely ceremonial. His confirmation in December 2025 that Rust driver contributions have accelerated, with NVIDIA’s Nova GPU driver standing out as the highest-profile all-Rust driver effort to date, suggests we’re past the proof-of-concept phase. When a major hardware vendor commits to shipping a production driver written entirely in Rust, that’s not theater. But growth and validation are not the same thing, and the kernel mailing list drama of the past two years tells you exactly why.

The Memory Safety Argument Gets Its First Real Test

The case for Rust in the kernel was always fundamentally about memory safety. Buffer overflows, use-after-free bugs, and double-frees don’t just cause crashes in kernel code. They open doors for attackers. The theoretical argument was compelling, but theory and practice are separated by the messy business of actually writing and maintaining millions of lines of systems code.

In 2025, researchers at the University of Waterloo published a detailed analysis of 150 kernel CVEs spanning 2020 to 2024. The findings were stark: 67 percent of those vulnerabilities fell into memory safety categories that Rust’s ownership model structurally prevents. That’s not a small number. That’s a majority. It means if the kernel had been written in Rust from the start, roughly two out of every three vulnerabilities in that sample set simply wouldn’t have existed. This isn’t theoretical anymore. This is empirical evidence that the memory safety argument has real teeth.

The implications reach beyond Linux. Google Security Blog on memory safety in Android reported that Android’s proportion of new OS code written in memory-safe languages reached 77 percent, with Rust accounting for the majority of systems-level additions. More significantly, memory safety vulnerabilities in Android dropped to below 24 percent of total CVEs for the first time. Google doesn’t publish these metrics lightly, and they don’t move this dramatically without something real happening under the hood.

The Abstraction Tax Nobody Wants to Discuss

Here’s where the story gets complicated, and where the kernel mailing list drama becomes essential rather than incidental. Late in 2025, Ted Ts’o, one of the most respected C maintainers in the kernel community, posted a detailed technical critique that cut through the cheerleading. His argument was specific and damning: Rust’s abstraction layers were introducing hidden performance regressions in I/O paths that standard benchmarks simply weren’t capturing. He wasn’t saying Rust was fundamentally broken. He was saying that the process of making Rust safe and ergonomic in a kernel context was creating overhead that nobody was measuring systematically.

This is the kind of critique that matters because it comes from someone who has spent decades optimizing kernel I/O. Ts’o isn’t a Rust skeptic by ideology. He’s a systems engineer pointing out that performance regression is a form of correctness failure in the kernel. When you add abstraction layers to prevent entire classes of bugs, you are making a trade. The Rust community’s argument was that the trade was worth it. Ts’o’s argument was that we weren’t even accurately measuring what we were trading away.

The response to Ts’o’s critique on the mailing list revealed the real state of the Rust integration. Some kernel developers acknowledged the performance concerns and committed to investigating. Others defended the abstractions as necessary infrastructure that would mature over time. A few suggested that Ts’o was conflating legitimate infrastructure concerns with ideological opposition to Rust. The conversation stayed largely technical and respectful, which itself is telling. If Rust integration were clearly failing, the discussion would have been angrier and shorter. If it were clearly succeeding, there would be no discussion at all.

Where We Actually Are

The Linux kernel is now at a point where Rust is no longer a controversial experiment that might be reversed. Too much code has been written. Too many maintainers have committed to the approach. The Nova GPU driver, in particular, represents a real crossing point: it’s a major, shipping driver written entirely in Rust, not as a research project but as production code that real users are depending on. You don’t ship that without confidence, and you don’t maintain it without institutional commitment from NVIDIA.

But Rust is also not the slam-dunk solution that some of its most enthusiastic advocates claimed it would be. The memory safety data is genuinely compelling. The performance overhead concerns are also genuine. Both things are true simultaneously. This is where the mailing list drama becomes valuable: it’s the space where a mature engineering community is working through real trade-offs rather than arguing from first principles.

For practical purposes, the current state of Rust in Linux kernel 6.1 and beyond looks like this: new driver development and subsystems that prioritize memory safety will increasingly be written in Rust. Existing C code won’t be rewritten wholesale. Performance-critical paths will remain under intense scrutiny. The community will continue to develop better tooling and abstractions. Over the next five years, we’ll probably converge on a kernel codebase that’s roughly 15 to 20 percent Rust by line count, concentrated in areas where memory safety is worth the abstraction cost.

That’s not the future that either the maximum-enthusiasm Rust camp or the skeptical C camp predicted. But it’s probably the most honest outcome of an honest engineering trade-off. The real lesson from two years of merge commits is that major systems transitions don’t happen because one side definitively wins the argument. They happen because both sides have legitimate points and a community finds a pragmatic middle ground. Less dramatic than pure victory, but that’s how you build systems that last.

The Work Ahead

If you’re building systems or evaluating technology choices, the Rust story in Linux tells you something worth sitting with: adoption of new approaches in mature systems happens incrementally, with constant friction, and only when the trade-offs are visible and honestly debated. There’s excellent documentation available in the Linux kernel Rust documentation if you want to see what the actual integration looks like beyond the mailing list rhetoric.

The kernel mailing list drama isn’t a bug in the process. It’s the feature. It’s the community working out what actually matters and what doesn’t. The fact that we can see that conversation happening in the open, with maintainers like Ts’o raising hard questions and the core team responding with thoughtful engagement, tells you that the kernel remains in capable hands. What’s your take on where this integration should go? The conversation is far from over, and it matters who’s thinking about it seriously.