Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The state of the kernel Rust experiment

lwn.net

Post reply on HN
Print view View original

11–20 of 148 posts

Re: The state of the kernel Rust experiment

#11

Post by taneliv »

rtpg wrote: post #4
yourdetect wrote: post #2

From the comment section: > To me the more salient questions are how long before (a) we get Rust in a core subsystem (thus making Rust truly _required_ instead of "optional unless you have hardware foo"), and (b) requiring Rust for _all_ new code. Previously, the position was that C developers would not be forced to learn Rust. And a few days ago a security vulnerability was found in the Rust Linux kernel code. https…

> And a few days ago a security vulnerability was found in the Rust Linux kernel code. was it a security vulnerability? I'm pretty sure it was "just" a crash. Though maybe someone smarter than me could have turned that into something more. I have no dog in this race, I really like the idea of Rust drivers but can very much understand retiscience at getting Rust to be handling more core parts of the kernel, just becau…

> was it a security vulnerability? I'm pretty sure it was "just" a crash.

It's a race condition resulting in memory corruption.[1][2] That corruption is shown to result in a crash. I don't think the implication is that it can result only in crashes, but this is not mentioned in the CVE.

Whether it is a vulnerability that an attacker can crash a system depends on your security model, I guess. In general it is not expected to happen and it stops other software from running, and can be controlled by entities or software who should not have that level of control, so it's considered a vulnerability.

[1] https://www.cve.org/CVERecord/?id=CVE-2025-68260 [2] https://lore.kernel.org/linux-cve-announce/2025121614-CVE-20...

Re: The state of the kernel Rust experiment

#13

Post by uecker »

AlotOfReading wrote: post #3
yourdetect wrote: post #2

From the comment section: > To me the more salient questions are how long before (a) we get Rust in a core subsystem (thus making Rust truly _required_ instead of "optional unless you have hardware foo"), and (b) requiring Rust for _all_ new code. Previously, the position was that C developers would not be forced to learn Rust. And a few days ago a security vulnerability was found in the Rust Linux kernel code. https…

Where did anyone promise that the Rust bits will never have security issues? That CVE was a fantastic demonstration of just how much better the situation is in Rust code and I don't think there's a realistic argument that the experiment has been anything other than successful.

Was it? It seems more a fantastic demonstration how the same type of errors can also occur in Rust code.

Re: The state of the kernel Rust experiment

#14

Post by jrimbault »

uecker wrote: post #13
AlotOfReading wrote: post #3

Earlier quoted context omitted.

Where did anyone promise that the Rust bits will never have security issues? That CVE was a fantastic demonstration of just how much better the situation is in Rust code and I don't think there's a realistic argument that the experiment has been anything other than successful.

Was it? It seems more a fantastic demonstration how the same type of errors can also occur in Rust code.

In C this kind of issue is so common it wouldn't raise to the status of "CVE". People would just shrug and say "git gud".

Re: The state of the kernel Rust experiment

#15

Post by uecker »

jrimbault wrote: post #14
uecker wrote: post #13

Earlier quoted context omitted.

Was it? It seems more a fantastic demonstration how the same type of errors can also occur in Rust code.

In C this kind of issue is so common it wouldn't raise to the status of "CVE". People would just shrug and say "git gud".

This is certainly not true. But also arguments about "common" are completely misleading as long as there is many orders of magnitude more C code than Rust code.

Re: The state of the kernel Rust experiment

#17

Post by aw1621107 »

RustSupremacist wrote: post #12

This author is not someone who should be reporting on Rust especially in the kernel: https://www.youtube.com/watch?v=gVC1gp2PS8U&t=1538s

Mind elaborating on what exactly is wrong in that video? Or how that is relevant to the article's contents?

Re: The state of the kernel Rust experiment

#18

Post by yourdetect »

AlotOfReading wrote: post #3
yourdetect wrote: post #2

From the comment section: > To me the more salient questions are how long before (a) we get Rust in a core subsystem (thus making Rust truly _required_ instead of "optional unless you have hardware foo"), and (b) requiring Rust for _all_ new code. Previously, the position was that C developers would not be forced to learn Rust. And a few days ago a security vulnerability was found in the Rust Linux kernel code. https…

Where did anyone promise that the Rust bits will never have security issues? That CVE was a fantastic demonstration of just how much better the situation is in Rust code and I don't think there's a realistic argument that the experiment has been anything other than successful.

[flagged]

Re: The state of the kernel Rust experiment

#19

Post by dannersy »

yourdetect wrote: post #2

From the comment section: > To me the more salient questions are how long before (a) we get Rust in a core subsystem (thus making Rust truly _required_ instead of "optional unless you have hardware foo"), and (b) requiring Rust for _all_ new code. Previously, the position was that C developers would not be forced to learn Rust. And a few days ago a security vulnerability was found in the Rust Linux kernel code. https…

There are lots of vulnerabilities in the C code, too. Should we remove C or do we accept that fact that no language is perfect since they are used by humans and continue to make improvements and use tools that help us along as time goes forward?

The cherry picking for this one Rust vulnerability to the ~150 C vulnerabilities is such a weird take that I can't help but think people have some weird hatred of Rust.

Re: The state of the kernel Rust experiment

#20

Post by yourdetect »

rtpg wrote: post #4
yourdetect wrote: post #2

From the comment section: > To me the more salient questions are how long before (a) we get Rust in a core subsystem (thus making Rust truly _required_ instead of "optional unless you have hardware foo"), and (b) requiring Rust for _all_ new code. Previously, the position was that C developers would not be forced to learn Rust. And a few days ago a security vulnerability was found in the Rust Linux kernel code. https…

> And a few days ago a security vulnerability was found in the Rust Linux kernel code. was it a security vulnerability? I'm pretty sure it was "just" a crash. Though maybe someone smarter than me could have turned that into something more. I have no dog in this race, I really like the idea of Rust drivers but can very much understand retiscience at getting Rust to be handling more core parts of the kernel, just becau…

[flagged]
Post reply on HN