Ubuntu 26.04 LTS Security: What's New and What's Still on You

Ubuntu 26.04 LTS (Resolute Raccoon) shipped on April 23, 2026. And for the first time in a while, the security story isn't just "we updated some packages." Canonical made architectural decisions in this release that change how the operating system protects itself at a fundamental level.

But — and this is the part that gets lost in the excitement — these improvements protect the system from certain classes of bugs. They don't protect you from downloading a malicious file, opening a trojanized package, or running a compromised script. Those are different problems that need different solutions.

Let me walk through what's genuinely new, what it means in practice, and where the gaps still are.

sudo-rs: your privilege escalation tool, rewritten in Rust

This is the headline change, and it deserves the attention it's getting.

sudo is the program that lets you run commands as root. Every time you type your password to install software or modify system files, you're trusting sudo to handle that privilege boundary correctly. The traditional sudo implementation (from sudo.ws) is written in C and has been around for decades. It works. But it's also had its share of memory safety vulnerabilities over the years — buffer overflows, use-after-free bugs, the kinds of issues that C makes easy to introduce and hard to catch.

Ubuntu 26.04 ships sudo-rs as the default. It's a complete rewrite of sudo in Rust, a language that prevents entire categories of memory corruption bugs at compile time. According to Canonical's engineering team, the traditional sudo remains available as a fallback, but sudo-rs handles all default privilege escalation.

What this means for you: the program that guards the boundary between "regular user" and "root" is now built with a language that makes buffer overflows structurally impossible. That's not a marketing claim — it's a property of Rust's type system and borrow checker.

Rust coreutils: ls, cp, mv — rebuilt from scratch

Beyond sudo, Ubuntu 26.04 ships Rust reimplementations of core system utilities — the commands you use every day like ls, cp, mv, cat, chmod, and dozens more. These come from the uutils project, and Canonical commissioned an independent security audit from Zellic (a well-known security research firm) before shipping them.

The audit ran in two phases between December 2025 and March 2026. Across both rounds, 113 issues of varying severity were identified and reported upstream. The uutils community resolved the vast majority before the LTS release.

So what does this mean practically? These utilities handle file operations — copying, moving, listing, changing permissions. Bugs in them can lead to data corruption, privilege escalation, or race conditions that attackers exploit. Rewriting them in Rust doesn't make them bug-free (the audit found 113 issues, after all), but it eliminates the memory safety bugs that have plagued C implementations for decades.

The traditional GNU coreutils remain installable for compatibility. But the default path now runs through memory-safe code.

Post-quantum SSH: future-proofing your connections

Ubuntu 26.04 ships OpenSSH 10.2 with hybrid post-quantum key exchange enabled by default. The specific algorithm is ML-KEM 768 combined with X25519 (written as mlkem768x25519 in your SSH config). DSA keys are removed entirely.

If you're not deep into cryptography, here's what this means: quantum computers don't exist at a scale that can break current encryption yet. But when they do (estimates range from 5 to 15 years), they'll be able to crack the key exchange algorithms that protect SSH connections today. The "harvest now, decrypt later" attack — where adversaries record encrypted traffic today to decrypt it once quantum computers arrive — is a real concern for sensitive communications.

By shipping post-quantum key exchange as the default, Ubuntu 26.04 protects your SSH sessions against future decryption without requiring you to configure anything. Your connections are secured against both classical and quantum attacks out of the box.

One practical note: if you SSH into older servers that haven't been updated, the connection will fall back to classical algorithms automatically. You won't notice any difference in daily use.

TPM-backed full-disk encryption

Ubuntu 26.04 introduces TPM-backed full-disk encryption as a first-class option during installation. If your machine has a TPM 2.0 chip (most machines manufactured after 2016 do), you can encrypt your entire disk with the key sealed to your hardware.

The practical benefit: your disk is encrypted at rest, and the key is tied to your specific hardware configuration. If someone pulls the drive out of your machine and puts it in another computer, they can't decrypt it — even if they know your password. The TPM ensures the key only unlocks on the original hardware with the original boot chain.

This is a meaningful improvement over the traditional LUKS setup where the encryption key is derived solely from your passphrase. A strong passphrase is still important, but TPM binding adds a hardware layer that's much harder to attack.

Linux kernel 7.0 and Rust drivers

Ubuntu 26.04 ships kernel 7.0, which expands Rust's presence in the kernel itself. New drivers and subsystems are being written in Rust, reducing the attack surface in the most privileged code on your system.

This is a long-term play. The kernel won't be rewritten in Rust overnight — it's 35 million lines of C. But new code going in with memory safety guarantees means fewer new vulnerabilities being introduced. Over time, the most security-critical paths will be hardened.

The Wayland-only display server (X11 removed at the display manager level) is another security win. X11's architecture allowed any application to read keystrokes and screen content from any other application — a design from 1984 that never accounted for hostile software. Wayland isolates applications from each other by default.

What Ubuntu 26.04 still doesn't protect you from

Here's where I want to be honest, because the upgrade excitement can create a false sense of security.

Ubuntu 26.04's security improvements protect the system from itself. They make it harder for bugs in system tools to become exploitable vulnerabilities. They make it harder for attackers to break encryption. They make it harder for applications to spy on each other.

They do not protect you from:

• Malicious files you download. If you grab a binary from a forum, a torrent, or a compromised repository, Rust coreutils won't save you. The file runs with your permissions and can do anything you can do.
• Trojanized packages. Supply chain attacks — where legitimate-looking packages contain hidden malware — are increasingly common. Ubuntu's package signing helps, but third-party PPAs, Flatpaks from unverified sources, and AppImages from random websites bypass that trust chain.
• Phishing and social engineering. No amount of memory-safe system tools prevents you from entering your password on a fake login page or running a script someone sent you.
• Zero-day kernel exploits. As Copy Fail and Dirty Frag demonstrated this month, kernel vulnerabilities still exist and still grant root access. Rust in the kernel helps long-term, but the vast majority of kernel code is still C.
• Malware that runs within your user permissions. A cryptominer, a keylogger reading your X11 session (if you're still on X11), or ransomware encrypting your home directory — none of these need root access, and none of them are stopped by sudo-rs or Rust coreutils.

Practical advice after upgrading

If you've upgraded to Ubuntu 26.04 (or you're planning to), here's how to get the most security value out of it:

Verify the new defaults are active

Check that sudo-rs is your active sudo implementation:

sudo --version

You should see sudo-rs in the output, not Sudo version 1.9.x.

Check your SSH is using post-quantum key exchange:

ssh -Q kex | grep mlkem

You should see mlkem768x25519-sha256 listed.

Enable TPM encryption if you haven't

If you did a fresh install, you likely got the option during setup. If you upgraded from 24.04, your existing LUKS setup carries over — you won't automatically get TPM binding. A fresh install is the cleanest path to TPM-backed encryption.

Keep your kernel updated

This sounds obvious, but it's the single most important security action on any Linux system. Ubuntu 26.04 will receive kernel updates for five years (ten with Ubuntu Pro). Apply them promptly and reboot.

Don't assume the OS handles everything

Ubuntu's security improvements are real and meaningful. But they're infrastructure-level protections. The files you download, the scripts you run, the packages you install from outside the official repos — those still need scrutiny. A local file scanner that checks new files against known threat signatures adds a layer that the OS doesn't provide.

Review your third-party sources

If you have PPAs, Flatpak remotes, or Snap sources beyond the Ubuntu store, audit them. Each one is a trust boundary. The fewer you have, the smaller your attack surface.

Last updated: May 2026