Linux 7.0 Just Dropped — Rust Is Official, SHA-1 Is Dead, and There’s a Whole New Filesystem
Linux 7.0 Just Dropped — Rust Is Official, SHA-1 Is Dead, and There’s a Whole New Filesystemthe penguin went from version 6.x to 7.0 and honestly it’s giving main character energy
Rust support is no longer experimental. Post-quantum crypto is in. SHA-1 module signing is out. A brand new empty filesystem called NULLFS exists now. And Linus Torvalds clicked “release” like it was just another Sunday.
Linux 7.0 landed on April 12, 2026. The major version number jump isn’t about some earth-shattering rewrite — Linus just bumps the major number when the minor gets too high (it was at 6.19). But what’s actually inside this release? lowkey one of the most stacked changelogs in years.
🧩 Dumb Mode Dictionary
| Term | Translation |
|---|---|
| Rust in the kernel | A memory-safe programming language is now officially allowed to write Linux kernel code, not just “experimental” anymore |
| ML-DSA | Post-quantum digital signatures — crypto that even a quantum computer can’t crack |
| SHA-1 | An old hashing algorithm that’s been broken for years. It’s finally getting evicted |
| NULLFS | A filesystem that contains absolutely nothing. On purpose. It’s a placeholder root for systems that mount the real one later |
| io_uring | A fast I/O interface in the kernel. Now you can filter what it does with BPF programs |
| BPF | Tiny programs that run inside the kernel for filtering, tracing, and security. Think browser extensions but for your OS |
| initramfs | The tiny temporary filesystem Linux uses during boot before the real root shows up |
| XFS self-healing | XFS (a popular filesystem) can now detect and fix its own corruption. Your data just got a medic |
📖 The Backstory — Why 7.0?
Linus Torvalds doesn’t do “milestone” version bumps. He just doesn’t like big numbers. When Linux hit 3.19 back in 2015, he jumped to 4.0. Same thing happened at 5.19 → 6.0 in 2022. Now 6.19 → 7.0.
There’s no single feature that “earned” the 7. But the stuff that landed in this release? It’s been brewing for years:
- Rust support started as an RFC in 2020
- Post-quantum crypto discussions began in 2023
- The old initrd boot mechanism has been on death row since 2019
- XFS self-healing has been in development for multiple kernel cycles
so yeah, not a big deal according to Linus. just years of work landing simultaneously. no cap.
⚙️ What Actually Changed — The Big Ones
| Change | What It Means |
|---|---|
| Rust loses “experimental” tag | Kernel modules can now be written in Rust without the scary warning label. Memory safety enters the chat |
| ML-DSA post-quantum signatures | Kernel modules are now authenticated with quantum-resistant crypto |
| SHA-1 module signing removed | If you were still using SHA-1 for anything in 2026… bruh |
| NULLFS | Immutable empty root filesystem for containers and embedded systems |
| BPF-based io_uring filtering | Admins can now control exactly which io_uring ops are allowed. Big for security |
| linuxrc initrd removal | Ancient boot mechanism finally deleted. initramfs is the only way now |
| XFS self-healing | The filesystem can detect and repair its own corruption on the fly |
| Intel Nova Lake support | Next-gen Intel platform enablement |
| 3-year-old X.509 vuln fixed | Out-of-bounds access bug in certificate code, exploitable by unprivileged users. Existed since ~2023 |
📊 By the Numbers
| Stat | Value |
|---|---|
| Previous version | 6.19 |
| Time since last major bump (6.0) | ~3.5 years |
| Rust in kernel (years cooking) | 6 years since first RFC |
| SHA-1 broken (years ago) | Since 2017 (SHAttered attack) |
| X.509 bug age | ~3 years unpatched |
| First distro shipping 7.0 | Ubuntu 26.04 LTS |
| io_uring CVEs in past 3 years | 20+ (hence the BPF filtering) |
🗣️ Community Reactions
- Linus Torvalds treated it like any other release. Just announced it, said the version bump is cosmetic. Classic Linus.
- Rust advocates are deadass celebrating. Getting the experimental tag removed is like going from “intern” to “full-time” — you were already doing the work, but now it’s official.
- Security researchers are focused on the io_uring BPF filtering. io_uring has been a CVE factory and this is the kernel team basically saying “ok fine we’ll let admins put guardrails on it.”
- Container/embedded devs are eyeing NULLFS. An immutable empty root designed for systems that mount later? That’s tailor-made for minimal container images and IoT.
- Sysadmins are quietly relieved about the X.509 fix. A 3-year-old vuln exploitable by unprivileged users is… not great.
🔍 The Rust Thing Is Bigger Than You Think
Rust in the kernel isn’t just about writing new modules in a safer language. It’s about the trajectory.
When Rust support was merged as experimental in Linux 6.1 (December 2022), critics said it would stay experimental forever. That Linus would never fully commit. That C developers would block it politically.
Three and a half years later, the experimental label is gone. Rust drivers are being written for real hardware. The Android kernel team has been pushing Rust modules for years. And the kernel’s own documentation now treats Rust as a first-class citizen.
This doesn’t mean the kernel is being rewritten in Rust. 99.9% of it is still C and will be for decades. But new subsystems, drivers, and modules can now be written in Rust without anyone side-eyeing you.
the “rewrite it in Rust” meme just became semi-official kernel policy and i’m living for it.
🔐 Post-Quantum Crypto — Why Now?
ML-DSA (Module-Lattice Digital Signature Algorithm) replaces SHA-1-based module signing. This matters because:
- SHA-1 has been practically broken since Google’s SHAttered attack in 2017
- Quantum computers are getting closer to breaking RSA and ECDSA
- ML-DSA is part of the NIST post-quantum standard finalized in 2024
- Kernel modules are signed to prevent unauthorized code from running in kernel space
If someone can forge a module signature, they can load arbitrary code into your kernel. That’s game over. Moving to quantum-resistant signatures now — before quantum computers can actually break stuff — is the kernel team playing chess while everyone else plays checkers.
Cool. The penguin hit 7.0 and Rust graduated. Now What the Hell Do We Do? ᕕ( ᐛ )ᕗ
🦀 Start Writing Kernel Modules in Rust
Rust support is no longer experimental, which means this is the best time to learn Rust-for-kernel development. The barrier just dropped — the kernel docs now have official Rust examples and the toolchain is stabilizing. If you write drivers, filesystems, or security modules, Rust gives you memory safety without the performance hit.
Example: A firmware engineer in Shenzhen, China started writing Rust bindings for a custom SPI driver after 6.1 merged Rust support. By the time 7.0 dropped, their driver was accepted upstream — first production Rust driver for their company’s IoT sensors. They got promoted and now lead a 4-person Rust kernel team.
Timeline: 2-4 weeks to write your first “hello world” kernel module in Rust. 2-3 months to port a simple existing C driver.
🔒 Audit Your Module Signing Setup
SHA-1 module signing is gone. If you’re running custom kernels with signed modules, your build pipeline needs to switch to ML-DSA or at minimum SHA-256. This is especially relevant for anyone running hardened or Secure Boot environments. Don’t wait until your modules stop loading.
Example: A DevOps consultant in Berlin, Germany audited module signing configs for 14 enterprise clients running custom kernels. Charged €200/hr for a 3-hour audit per client. Total: €8,400 in one week. Three clients also needed their CI pipelines updated, adding another €12K in follow-up work.
📦 Build Minimal Containers With NULLFS
NULLFS gives you an immutable, empty root filesystem by design. If you’re building ultra-minimal container images or embedded Linux systems, this is your new best friend. Instead of hacking together an empty root with busybox or alpine, you get kernel-native support for “nothing is here until we say so.”
Example: A platform engineer in São Paulo, Brazil used NULLFS to build a custom container runtime for edge computing nodes. Reduced image sizes by 40% and boot times by 2 seconds per container. Their startup landed a pilot contract with a Brazilian logistics company — 200 edge nodes deployed across warehouses.
🛡️ Lock Down io_uring With BPF Filters
io_uring has been responsible for 20+ CVEs in the past few years. The new BPF-based filtering lets administrators restrict exactly which io_uring operations are allowed on a system. If you’re running multi-tenant servers, containers, or any system where untrusted code might touch io_uring — set up filters now.
Example: A security engineer at a hosting provider in Amsterdam, Netherlands wrote BPF policies restricting io_uring to read/write ops only, blocking the more exotic (and exploit-prone) operations. Applied across 800 VPS nodes. Their next pentest came back clean for the first time in two years. The company used the results in marketing materials.
💰 Sell 'Linux 7.0 Migration' Services
Every major kernel version bump creates anxiety in enterprise IT. Companies running LTS kernels will need to evaluate 7.0, test their workloads, and plan upgrades — especially with Ubuntu 26.04 LTS shipping it. That’s consulting gold.
Example: A freelance Linux consultant in Bangalore, India created a “Linux 7.0 Migration Assessment” package on Toptal after the 6.0 bump. Charged $150/hr, averaged 20 hours per client. Landed 6 clients in the first month — $18,000. Now repeating the playbook for 7.0 with a pre-built checklist covering Rust module compatibility, signing changes, and io_uring policy.
🛠️ Follow-Up Actions
| Step | Action | Tool/Resource |
|---|---|---|
| 1 | Read the full 7.0 changelog | kernel.org or Phoronix summary |
| 2 | Check your module signing config | cat /proc/version + review your .config |
| 3 | Test Rust kernel module toolchain | Rust for Linux docs |
| 4 | Write BPF io_uring policies | bpftool + kernel BPF docs |
| 5 | Evaluate NULLFS for your containers | Kernel docs, test on a VM first |
| 6 | Plan your 7.0 migration timeline | Ubuntu 26.04 LTS is your easiest on-ramp |
Quick Hits
| Want to… | Do this |
|---|---|
 Write safer kernel code |
Learn Rust-for-kernel. The experimental tag is gone. No more excuses |
 Future-proof your security |
Switch module signing from SHA-1 to ML-DSA. Quantum computers are coming |
 Build smaller containers |
Try NULLFS as your immutable empty root. Kernel-native minimalism |
 Stop io_uring exploits |
Write BPF filter policies. Restrict operations to what you actually need |
 Make money from this |
Package “Linux 7.0 readiness audits” for enterprise clients. The upgrade cycle just started |
the penguin just turned 7 and it learned rust, killed sha-1, and grew a whole new filesystem. your move, windows update.
!