By Matt Busel, who built the apps, crates and game he writes about · every number links to its source and every dataset is downloadable (methods) · corrections · featured in Kirino, gamebiz, This Week in Rust, New Mobile Life, By-Press
systemd lets Rust in: 0 of its last 14 CVEs were memory bugs
On this page · 9 sections
- Key numbers
- Rust got into PID 1's house, on a short leash
- The data: systemd's memory bugs already stopped
- What broke systemd since 2023: logic, not memory
- So is Rust in systemd pointless? No. Here is the real bet
- By the numbers: three eras of systemd bugs
- Who blocks it? We looked, and the answer is nobody
- What this means for you
- Sources
Short answer: Yes, systemd now accepts programs written in Rust. Christian Brauner's pull request #44324 merged on October 24 2026, adding 5,144 lines. But our pull of every systemd CVE in the US National Vulnerability Database says the bug Rust kills best, memory corruption, has not shown up in systemd since November 2022. The next systemd bugs will be logic bugs, and no language fixes those for you.
TL;DR: NVD lists 55 CVEs against systemd, and 15 of them (27%) are memory-safety weaknesses like buffer overflows and use-after-free. All 15 landed between 2013 and 2022; the 14 CVEs published from 2023 to October 2026 contain zero. Rust is 0.36% of the systemd codebase today and the maintainers limited it to new leaf programs, no cargo and no outside crates, so the real win is the next new component, not the 45 MB of C already there.
Key numbers
| What | Number | Source, checked Oct 27 2026 |
|---|---|---|
| systemd CVEs in NVD | 55 | NIST NVD API |
| Memory-safety CVEs (overflow, out-of-bounds, use-after-free, null deref, unbounded allocation) | 15 (27%) | NIST NVD API, our CWE tagging |
| Memory-safety CVEs, 2018-2022 | 11 of 27 | NIST NVD API |
| Memory-safety CVEs, 2023-Oct 2026 | 0 of 14 | NIST NVD API |
| Last memory-safety CVE | CVE-2022-3821, Nov 8 2022 | NVD |
| Rust PR size | +5,144 / -11 lines, 54 files | systemd PR #44324 |
| Rust share of systemd source | 0.36% (185 KB of 51 MB) | GitHub languages API |
Rust got into PID 1's house, on a short leash
systemd is the program that boots most Linux machines and keeps their services alive. When it breaks, the box breaks.
The rules came out of the maintainers' Berlin hackfest, and Brauner spelled them out in the PR: Rust only for new leaf components, existing C is not ported, nothing other parts depend on is written in Rust, no cargo, everything built with meson.
The code is no_std (Rust without its standard library) and uses only the core, alloc and libc crates. It even skips Rust's own collections, because they abort when memory runs out. systemd ships its own Box and Vec that return an error instead, the same trick the Linux kernel uses.
The first customer is systemd-keyring-setup, a new tool that enrolls certificates into kernel keyrings. That is the pattern: new security-sensitive code gets the safe language first.
The data: systemd's memory bugs already stopped
We pulled all 55 systemd CVEs from NVD and tagged each by its weakness type (CWE). Overflows, out-of-bounds reads and writes, use-after-free, null dereference, integer overflow and unbounded allocation count as memory-safety.
The worst ones are exactly what Rust prevents. CVE-2015-7510 was a stack buffer overflow in nss-mymachines, scored 9.8. CVE-2022-2526 was a use-after-free in systemd-resolved, also 9.8. CVE-2018-15688 let a hostile DHCPv6 server overflow a buffer in the client.
Then the line goes flat. After the off-by-one in CVE-2022-3821 in November 2022, NVD has no memory-safety CVE against systemd at all.
What broke systemd since 2023: logic, not memory
The 14 CVEs since 2023 are integrity-check gaps in sealed journal logs (three of them), privilege handling, authorization, and data crossing a trust boundary it should not cross.
The April 2026 batch alone had six: a local privilege escalation in systemd-machined via varlink (CVE-2026-40224), local root via malicious hardware in udev (CVE-2026-40225), and an nspawn container escape (CVE-2026-40226).
Rust's borrow checker does not stop any of those. A Rust program can trust the wrong input, grant the wrong permission or forget to check a signature just as easily as C can.
So is Rust in systemd pointless? No. Here is the real bet
Our read: the quiet since 2022 is not C getting safe. It is years of fuzzing, hardening and a few very careful people paying a tax on every line. That tax does not scale to new code written by new contributors.
Rust moves the tax to the compiler. New leaf programs like keyring-setup start life with a whole bug class closed, so reviewers spend their attention on the logic bugs that actually ship now.
The people who should be nervous are the "rewrite it all in Rust" crowd and the "Rust is a fad" crowd at the same time. systemd picked neither: no rewrite, no ban, a fenced yard for new code. Our bet is that this fence is the template Debian, Fedora and the kernel tooling copy next.
By the numbers: three eras of systemd bugs
2013 to 2017: 14 CVEs, 4 memory-safety (29%). The young project, with an integer overflow in journald and the stack overflow in nss-mymachines.
2018 to 2022: 27 CVEs, 11 memory-safety (41%). This was the peak, when researchers hammered journald, resolved and the DHCP client. Three of them (CVE-2018-16864, 16865 and 16866) were published the same day, all against journald.
2023 to October 2026: 14 CVEs, 0 memory-safety. Severity did not vanish either: the 2026 batch includes local root and a container escape, scored up to 6.7.
Across all 55, 19 scored 7.5 or higher, and 9 of those 19 were memory bugs. So when systemd had a truly dangerous bug, close to half the time it was the kind Rust closes by construction. That is the limit worth pushing back: the next new daemon should never be able to add a tenth.
Who blocks it? We looked, and the answer is nobody
The PR merged with five comments and a split Lennart Poettering asked for to make review easier. No veto, no flame war in the thread. The limits on Rust (no cargo, no crates, leaf only) are engineering choices about build reproducibility and supply chain, not a turf fight.
That matters given what we found this week: a 10.0 RCE in the zip crate left Rust projects stuck on old versions. systemd's "no outside crates" rule means that class of bug cannot reach PID 1 through a dependency.
What this means for you
- If you run Linux servers: Rust in systemd changes nothing today. Patch for the April 2026 CVEs (systemd 260/261), which are logic bugs. Download our CSV of all 55 CVEs and check your version against it.
- If you maintain a C project: copy the systemd recipe. Fence Rust to new leaf code, ban outside crates in the core, keep your build system. You close the memory class for everything new without a rewrite.
- If you write Rust: the next wave of bugs is logic. Spend review time on permissions, input trust and signature checks, the things the compiler will not catch.
More: our Rust hub, the Rust article archive, the crates we track and the news desk.
Stuck on a Rust build, a dependency bump or a CVE you cannot patch cleanly? Get it fixed: fixed within 24 hours or a full refund.
Sources
- systemd PR #44324, "rust: support programs written in Rust", Christian Brauner, merged Oct 24 2026
- systemd PR #44114, keyring-setup, Oct 2026
- NIST National Vulnerability Database API, CPE systemd_project:systemd, pulled Oct 27 2026
- GitHub languages API, systemd/systemd, pulled Oct 27 2026
- r/rust, "systemd adds support for programs written in Rust", Oct 2026
First published here on tensorust.com on Oct 27, 2026. Related: .
Up next
More on Rustzip crate CVE: 77% of top Rust dependents can't get the 10.0 fixThe zip crate fixed a critical CVE in 9.0.5, but 232 of the 300 biggest crates using it pin an older major. Only 16.4% of daily downloads are patched.Read it next →Cite this
Free to cite and reuse under CC BY 4.0 with a link back. How it was collected: methods. Spotted an error? Corrections.
Did this answer your question?
Get the next one by email.
What my AI agents tried this week, with the real numbers: what worked, what flopped, what made money. One email when there is something worth reading.
No spam, never sold. Every email has a one-click unsubscribe.
What are people saying about this? Read and post on The Floor →
More: the author, related reading, share this, a free game
Try it yourself · Rust dev?
Check a crate before you depend on it
Release health, reverse deps, real downloads and the alternatives for 1000 crates.
In The Manual: on this topic
Explainers answer one question, short answer first. Guides walk you through it step by step.
- Guide · Rust and cratesHow to check your Cargo.lock for vulnerabilities with cargo audit
- Guide · Rust and cratesHow to vendor Rust dependencies with cargo vendor for offline builds
- Explainer · Shipping and sellingSnowflake ID vs UUID: which should you use?
- Explainer · Shipping and sellingUUID vs NanoID: which ID should you use?
Read next
- Dev · Oct 27, 2026 · 6 min readzip crate CVE: 77% of top Rust dependents can't get the 10.0 fix
- Dev · Oct 26, 2026 · 6 min readOpen source is an unpaid utility, and the EU just sent the bill
- Dev · Oct 26, 2026 · 6 min readOffline Rust builds: 17,527 downloads, almost nobody is shutdown-ready
.jpg){kind=link}