Rust cp bug forces Ubuntu to revert to GNU Coreutils
A Rust rewrite of cp started breaking Ubuntu builds, and Foundations pulled the command back to GNU while Canonical keeps pushing toward 100% rust-coreutils.
Ubuntu Foundations reverted cp back to GNU after a bug in uutils coreutils started breaking Ubuntu builds, a sharp reminder that core utilities are not the place for a sloppy regression. The team said on July 3, 2026 that it had “Reverted cp back to GNU” in Launchpad bug LP: #2158691, and it had already pushed an upstream pull request for the fix.
That rollback landed in the middle of Canonical’s wider plan to replace GNU Coreutils with Rust-based clones across Ubuntu. Canonical shipped rust-coreutils as the default in Ubuntu 25.10 to get real-world testing before the LTS, and it has said the target is Ubuntu 26.10 with 100% rust-coreutils. Even so, Ubuntu said in April 2026 that cp, mv, and rm would stay on GNU Coreutils in Ubuntu 26.04 because unresolved time-of-check/time-of-use problems still blocked confidence for an LTS.
The cp failures were not an isolated gripe. Ubuntu Security had already published CVE-2026-35350 on April 22, 2026, a medium-severity issue with a CVSS 3.0 base score of 6.6, after finding that uutils cp could preserve setuid and setgid bits when ownership preservation failed. GNU cp clears those bits. Ubuntu also flagged CVE-2026-35359, a TOCTOU race in cp around no-dereference handling, and CVE-2026-35358, where recursive copies mishandled character and block device nodes and could even turn /dev/null into a regular file.
The bigger picture is that Canonical has not backed off the Rust transition, but it has been forced to treat it like distro infrastructure, not a proof-of-concept. Ubuntu said as of April 22 there were still eight open TOCTOU issues across cp, mv, and rm. To harden the transition, Canonical commissioned an external audit from Zellic after deciding an internal review was not enough for LTS confidence. Zellic’s two rounds, from December 2025 to January 2026 and again from February 2026 to March 2026, turned up 113 issues and fed 30 upstream mitigation pull requests.
That is the real story behind the rollback: cp is tiny, ubiquitous, and dangerous to get wrong. When the command that every build depends on starts dropping the floor out from under Ubuntu’s packaging flow, even a Rust rewrite has to yield to the boring reliability of GNU Coreutils until the transition can survive distro-scale reality.
This article was produced by Prism’s automated news system from verified source data, official records, and press releases, then run through automated quality and moderation checks before publishing. The system is built and supervised by the people who set the standards it runs under. Read our full AI policy.
Did this article answer your question?
