FOSSWire
Search/
Distro Planets

Ubuntu 26.10 hardens boot chain, migrates coreutils to Rust, adds post-quantum crypto

Brief written by the FOSSWire AI editor from Planet Ubuntu How we write

2 min read 14 reads

Key Takeaway

Ubuntu 26.10 reduces attack surface with a stripped-down signed GRUB, completes migration of core utilities to Rust, and ships OpenSSL 4.0 with post-quantum cryptography and Encrypted Client Hello support.

Summary

Ubuntu 26.10 'Stonking Stingray' introduces multiple security-focused changes: signed GRUB builds drop support for Btrfs, ZFS, XFS, HFS+, LVM, LUKS, and most RAID configurations under Secure Boot to reduce parser attack surface. TPM-backed full disk encryption now works on systems lacking a hardware root of trust, requiring a PIN at installation. The default core utilities are now entirely Rust-based, completing the migration begun in 26.04 LTS. OpenSSL 4.0 and OpenSSH 10.5 add post-quantum algorithms, Encrypted Client Hello, and the upki certificate revocation system. dbus-broker replaces dbus-daemon as the default message bus, and the Rust-based ntpd-rs time daemon is available for testing.

What changes in Ubuntu 26.10's security stack

  • GRUB attack-surface reduction: Signed builds retain only ext4, FAT, ISO9660, squashfs support; Btrfs, XFS, ZFS, HFS+, JPEG/PNG parsers, Apple partition tables, LVM, LUKS, and non-RAID1 software RAID removed from Secure Boot path. Full functionality remains with Secure Boot disabled.
  • TPM-backed encryption expansion: Previously limited to machines with hardware root of trust (most PCs post-2021); now available on older systems with PIN/passphrase requirement at install. PIN can be removed later, but removes firmware tampering protection.
  • Rust coreutils completion: uutils coreutils becomes fully default; cp, mv, rm migrate from GNU implementations. Compile-time and runtime safety checks address use-after-free and out-of-bounds access.
  • OpenSSL 4.0: First major version since 3.0. Adds curveSM2MLKEM768 hybrid KEM, ML-DSA-MU pseudo-digest, cSHAKE. ECH support available when applications enable it. ENGINE interface removed; providers required. SSLv3 removed. Deprecated elliptic curves restricted.
  • upki revocation: System-level CRLite-based revocation checking integrated with curl in 26.10; background-updated local cache eliminates per-connection online CA queries.
  • dbus-broker default: Replaces dbus-daemon with AppArmor mediation preserved.
  • ntpd-rs: Memory-safe NTP daemon available for testing, not default.

Why it matters

The GRUB changes may force users with custom /boot layouts to either disable Secure Boot or remain on 26.04 LTS with Ubuntu Pro Legacy support through 2041. The Rust coreutils migration and OpenSSL ENGINE removal require testing for scripts and HSM/TPM workflows before production deployment.

Original reference: ubuntu.com →