The Numbers Tell a Story, But Not the One You Might Expect
If you’d told me in late 2022 that we’d go from 13,000 lines of Rust code in the Linux kernel to over 600,000 lines in just three years, I would have believed you. If you’d told me the transition would be *smooth*, I would have asked what conference you were attending, because that’s not how the kernel mailing list works. The reality sits somewhere in between, which is exactly where the interesting problems live.
The growth itself is remarkable. We’re talking about Rust code now embedded across drivers, filesystem abstractions, and core subsystem bindings. The Nova GPU driver for NVIDIA is the highest-profile example, an all-Rust driver effort that Linus Torvalds himself confirmed has accelerated kernel contributions in this space. That’s not a small thing. That’s the maintainer of the entire Linux kernel saying “yes, this is working.” But working and *optimized* are different animals, and that distinction matters when you’re operating at kernel scale.
The Memory Safety Argument Isn’t Hypothetical Anymore
Here’s where the narrative gets empirical teeth. A 2025 study from the University of Waterloo analyzed 150 Linux kernel CVEs spanning 2020 through 2024. The finding: 67 percent of those vulnerabilities fell into memory safety categories that Rust’s ownership model structurally prevents. Not mitigates. Prevents. That’s the kind of data point that stops handwaving arguments in their tracks.
This isn’t me cherry-picking isolated incidents. Google’s Android team documented this in real time with their Google Security Blog on memory safety in Android. They pushed the proportion of new Android OS code written in memory-safe languages to 77 percent, with Rust accounting for the majority of systems-level additions. The payoff shows up in the vulnerability metrics: memory safety bugs dropped below 24 percent of total Android CVEs for the first time. That’s not theoretical safety. That’s operational evidence.
If you’ve ever woken up at 3 AM because someone exploited a use-after-free vulnerability in production, you understand why this matters. The Rust ownership model catches that class of bug at compile time. Every single time. That’s not a philosophy. That’s a promise the compiler keeps.
The Mailing List Wars, And What They Actually Reveal
Now, let’s talk about what broke the internet in late 2025. Ted Ts’o, a veteran C kernel maintainer whose opinion carries weight because he has genuinely earned it, posted a detailed technical critique on the kernel mailing list. His argument: Rust’s abstraction layers were creating hidden performance regressions in I/O paths that conventional benchmarks weren’t capturing. He wasn’t saying Rust was bad. He was saying we weren’t measuring the right things.
And here’s the part that made me smile, because this is how systems engineering actually happens: he was right to push back. The drama wasn’t failure. The drama was the system working. Ts’o raised a specific, measurable concern backed by analysis. The Rust maintainers took it seriously and dug in. That’s not a kernel culture problem. That’s kernel culture functioning as designed, albeit loudly.
This is where beginners often get confused by the noise. The kernel mailing list looks like a warzone to the uninitiated. People disagreeing vehemently about compile times, abstraction layers, and performance characteristics. But that intensity is *why* Linux works. It’s adversarial code review at scale. Everyone assumes the worst of every proposal until proven otherwise. Rust, being a new addition to a 30-year-old codebase, gets extra scrutiny. That’s fine. That’s how you earn trust.
What This Means For You, Starting Today
If you’re interested in contributing to Rust in the kernel, the path is clearer than it was two years ago, but it still requires patience. Start with the Linux kernel Rust documentation. Read it. Then read it again, because kernel documentation is terse and every sentence carries weight. The abstractions are there. They’re solid. They’re also real. You’re not working with toy examples.
Pick a driver. Not the GPU driver. Not the filesystem. Start with something smaller, a network adapter driver, a USB peripheral handler, something that will teach you how to bridge Rust’s safety model with hardware semantics without overwhelming you with an entire subsystem’s context. Build something that compiles. Test it on real hardware if you can. Break it. Fix it. Submit it. That’s the onboarding.
The kernel doesn’t care that Rust code has been growing exponentially. The kernel cares that your code doesn’t crash production. It doesn’t care about the language wars on Twitter. It cares that your patch survives twelve months of real-world use without a single memory safety bug. That’s the bar. Always has been. Rust just happens to make reaching that bar more achievable, which is why the growth trajectory, despite the drama, keeps accelerating.
The Actual Lesson Here
Two years and 600,000 lines into this experiment, the story isn’t about Rust winning or C losing. It’s about a massive, mission-critical system genuinely adapting to include a safer alternative without pretending the transition is painless. Ts’o’s late-2025 critique didn’t derail the effort. It refined it. The Waterloo study didn’t settle debate. It gave us language to quantify what we actually care about. The Android numbers didn’t end kernel culture disputes. They shifted the conversation from theology to measurement.
If you’re sitting on the sidelines wondering whether to invest in learning Rust for kernel development, the answer isn’t “yes because memory safety.” The answer is “yes because the kernel community is taking this seriously, the abstractions are real, the vulnerabilities you’ll prevent are quantifiable, and there are genuine contributions waiting for people who understand both the language and the domain.” That’s a harder sell than slogans, but it’s also true. What specific piece of the kernel have you been wanting to understand better? Start there.