Rust-for-Linux
The Linux kernel is written almost entirely in C, and the most dangerous, hardest-to-find bugs in it are memory-safety bugs - use-after-free, buffer overflows, data races - the very class of bug C does nothing to prevent and a memory-safe language could rule out. Rust-for-Linux is the ongoing effort to let parts of the kernel be written in Rust, a language whose compiler enforces memory and thread safety at compile time, so that new kernel code can be safe by construction rather than safe by careful review.
Concretely, it adds Rust support to the kernel's build system and provides safe Rust wrappers ('bindings') around the kernel's existing C interfaces, so a driver written in Rust can call into the C kernel through APIs that the Rust compiler can reason about. The promise is real: in safe Rust, the borrow checker rejects code that could free memory still in use, index out of bounds, or share mutable data across threads without synchronization - whole categories of classic kernel vulnerabilities simply do not compile. The first Rust code merged into mainline Linux was infrastructure and a few drivers, and the effort is deliberately incremental: the enormous existing C codebase is not being rewritten.
It matters as a landmark - a second language entering one of the world's most important and conservative C codebases, aimed squarely at the bug class that causes most kernel security holes. But the honesty here is the whole point. This is partial and ongoing: most of the kernel remains C, and the boundary where Rust meets C requires unsafe Rust and hand-written bindings, where the compiler's guarantees do not apply and a mistake can reintroduce exactly the bugs Rust was meant to prevent. Rust's safety holds for safe code only; it does not stop logic errors, deadlocks, or leaks, and it does not retroactively fix the C around it. The right read is 'a promising, incremental hardening of new code,' not 'the kernel is now memory-safe.'
// safe Rust kernel code: the borrow checker rejects whole bug classes at compile time // - using memory after it is freed -> won't compile // - indexing past the end of a slice -> bounds-checked // but the C<->Rust boundary needs `unsafe { ... }` + hand-written bindings, // where the compiler's guarantees DO NOT apply and a slip reintroduces the old bugs
Safe Rust eliminates classic memory bugs at compile time, but the unavoidable unsafe boundary to the C kernel is where guarantees lapse - the work is genuinely partial.
This is incremental, not a rewrite: most of Linux stays C, and the C-to-Rust boundary uses unsafe Rust where the safety guarantees do not hold. Rust prevents memory-safety bugs in safe code only - not logic errors, deadlocks, or leaks - so 'Rust in the kernel' is a hardening of new code, not a claim that the kernel is now safe.