---
title: "Rust replaces C in Android’s Binder as memory bugs fall from 76% to under 20%"
summary: "Linux merged the removal of Android’s C Binder driver on 24 October. Google’s Android figures, 2019–2025, show what memory-safe code did to its bug share."
url: https://www.thetechbag.com/blog/rust-binder-linux-android-memory-safety
format: Trend
desk: "Cloud & DevOps"
published: 2026-10-24
facts_checked: 2026-10-24
author: TechBag (The TechBag Journal)
tags: ["Rust","Linux kernel","Android","Binder","memory safety","C++","Google","CISA"]
cover: https://www.thetechbag.com/blog/covers/rust-binder-linux-android-memory-safety.png
---

# Rust replaces C in Android’s Binder as memory bugs fall from 76% to under 20%

*Linux merged the removal of Android’s C Binder driver on 24 October. Google’s Android figures, 2019–2025, show what memory-safe code did to its bug share.*

Trend · Cloud & DevOps · By TechBag · Published 2026-10-24 · Facts checked 2026-10-24 · Canonical: https://www.thetechbag.com/blog/rust-binder-linux-android-memory-safety

The short version

- Linux 7.4 is set to ship without Android’s original C Binder driver. The Rust rewrite, written by Google engineers and accepted in September 2025, takes its place; Greg Kroah-Hartman says it “will be used going forward in a few billion devices”.[1]
- Google’s own figures: memory-safety bugs fell from 76% of Android’s vulnerabilities in 2019 to under 20% in 2025, as most new code moved to memory-safe languages. Google calls it a correlation, and credits new code, not rewrites.[3][5]
- Nothing changes in a purchase order. The driver reaches phones through device makers’ kernels; what a buyer can ask a software supplier for is the memory-safety roadmap US agencies requested by the end of 2025.[13]

Late on 24 October, US Pacific time, Linus Torvalds merged the driver changes for Linux 7.4 that delete the C version of Binder, the kernel driver every Android app and system service uses to talk to the others. Kroah-Hartman, who sent the changes, wrote: “the rust version is stable and will be used going forward in a few billion devices. Great job by those developers”. The merge removes 12 C files, about 11,400 lines.[1] It is the newest point on a longer line: across Android as a whole, the share of security bugs caused by memory mistakes has fallen for six years.

## The line: Android's memory-safety share, 2019 to 2025

Google has published the series three times. In December 2022 it reported that memory-safety vulnerabilities fell from 223 in 2019 to 85 in 2022, from 76% to 35% of all Android vulnerabilities, and that Android 13 was the first release in which most new code was in a memory-safe language. It added: “correlation doesn’t necessarily mean causation”.[3] In September 2024 the share was 24%, “well below the 70% industry norm”, with the 2024 count extrapolated to 36 (27 at the time).[4] That norm is visible elsewhere: Chromium counts around 70% of its high-severity security bugs as memory-safety problems.[6] In November 2025 Google reported the share “below 20% of total vulnerabilities for the first time”.[5]

**Figure: Memory-safety bugs went from three in four Android vulnerabilities to under one in five**

*Memory-safety vulnerabilities as a share of all Android vulnerabilities, years Google published, 2019–2025*

|  | Memory-safety share |
| --- | --- |
| 2019 | 76 |
| 2022 | 35 |
| 2024 | 24 |
| 2025 (below) | 20 |

Source: Google Security Blog (Dec 2022, Sep 2024); Google (Nov 2025) · as of 13 November 2025 · 2025 is 'below 20%' with no exact figure, drawn at the 20% ceiling. Years without a published figure are omitted. Google calls the link to new-code language a correlation, not causal.

The 2025 post adds Google’s measured density: about 0.2 vulnerabilities per million lines of Rust, against “closer to 1,000” memory-safety vulnerabilities per million lines in its historical C and C++. Rust changes also spent about 25% less time in code review, and medium and large ones were rolled back about four times less often than C++ changes.[5]

## What drives it: what memory safety is, and why C allows the bugs

A program keeps its data in memory, in slots it asks for, uses and hands back. A memory-safety bug is a mistake in that bookkeeping: writing past the end of a slot (a buffer overflow), or using a slot after handing it back (a use-after-free). Either can let an attacker overwrite data the program trusts. C gives the programmer raw memory addresses and does not check what is done with them; that is what makes it fast and close to the hardware, and what lets these mistakes through. Java and Go check at run time and clean up memory automatically. Rust checks before the program runs: its compiler refuses code that breaks its ownership rules, except inside blocks marked `unsafe`, which is why it can be used where C is, in kernels and drivers.

Binder shows the bug class plainly. On 16 September a fuzzer-found use-after-free write in the C driver’s device-registration code was fixed.[8] One bug proves nothing alone. Google’s engineers gave their reasons in the Rust driver’s commit: “We’re generally not proponents of rewrites”, but Binder “combines/nests 13 different locks, 7 reference counters, and atomic variables”, and Rust “prevents mistakes with ref counting, locking, bounds checking”. The Rust driver came out at 5,500 lines against 5,800 for C, on their count.[2]

**Figure: The Rust driver ran alongside C for 13 months before the C one was removed**

*Rust Binder in the Linux kernel, September 2025 to October 2026*

| Date | Event | Detail |
| --- | --- | --- |
| 19 Sept 2025 | Rust Binder accepted | first shipped in Linux 6.18 |
| 13 Nov 2025 | Google: first production Rust driver | Android's 6.12 kernel |
| 16 Dec 2025 | First Rust Binder CVE | in an unsafe block; fixed in 6.18.1 |
| 16 Sept 2026 | C driver bug fixed | use-after-free write, found by fuzzing |
| 24 Oct 2026 | C Binder removed | Linux 7.4 merge |

Source: Linux kernel commits; CVE record; Google · as of 24 October 2026

Rust has limits its users record. The first CVE in the kernel’s Rust code, in December 2025, was in Rust Binder: a race inside an `unsafe` block that corrupted list pointers and crashed the kernel.[7] About 4% of Android’s Rust sits in such blocks, and Google caught its first Rust memory-safety bug, in an image decoder, before release.[5] Google’s 2024 finding is that “the problem is overwhelmingly with new code”, and that returns on rewrites “diminish over time as code gets older”.[4]

ReportedPositions, as their holders stated them

- Christoph Hellwig, DMA maintainer, January 2025: adding another language would make Linux “impossible to maintain”;[9] The Register reported that he likened a multi-language codebase to cancer, and that he later stepped down from DMA maintenance.[10]
- Linus Torvalds, February 2025: “You are not forced to take any Rust code”, but “‘ignore the Rust side’ automatically also means that you don’t have any say on the Rust side.”[10]
- Kroah-Hartman, February 2025: most bugs are “the stupid little corner cases in C that are totally gone in Rust”.[10]
- Miguel Ojeda, Rust-for-Linux lead, December 2025: “the experiment is done, i.e. Rust is here to stay.”[11]
- In C++, a September 2025 vote of the language committee’s safety group put Bjarne Stroustrup’s “profiles” (30 of 45 in favour) ahead of Sean Baxter’s Rust-style Safe C++ (20 of 45). Baxter: “Safe C++ is not being continued”, and profiles “will not ever work”. Stroustrup: the committee “did not guarantee that this would be in C++ 26.”[12]

## What it means for a buyer

Nothing to switch or license. The C driver stays in every kernel up to 7.3, including the long-term branches device makers build on; 7.4 is the first without it.[1][16] When a given phone runs Rust Binder depends on its maker’s kernel, which the buyer does not choose. What a fleet owner can see is the Android security patch level, and what a supplier can be asked for is the plan US agencies set out: build new product lines in memory-safe languages and publish a memory-safety roadmap for existing products by the end of 2025. CISA and the FBI call that voluntary, for products used in critical infrastructure.[13]

Our viewThe question to put to a supplier

Ask what share of new code goes into memory-safe languages, and since when. It is the measure Google tracked against its vulnerability line, and a roadmap without it is hard to check.

In India

Android ran 93.97% of mobile web traffic in India in September 2026, by StatCounter’s page-view count.[14] The Binder change therefore reaches almost every phone an Indian company manages, on each maker’s timetable. We found no Indian guidance on memory-safe languages; the US roadmap request is the nearest reference for a supplier question.

**What to watch.** The November Android Security Bulletin is due on Monday 2 November, under Google’s rule of the first Monday of each month.[15] Google’s next annual memory-safety figure has no announced date; the last three came in December 2022, September 2024 and November 2025.[3][4][5] Then Linux 7.4 itself, the first release with only the Rust driver: Linux 7.3 was released on 18 October.[16]

How we did this

Figures as of 24 October 2026

The memory-safety series is Google’s, from its three posts, covering first- and third-party Android code; we added no estimate. The 2025 value is shown at the 20% ceiling Google gives. The C lines removed are our sum of the 12 C files and tests the 7.4 merge deletes from `drivers/android` (11,411 lines); the Rust and C line counts for the driver are Google’s. The merge carries a UTC timestamp of 01:44 on 25 October, 18:44 on 24 October in US Pacific time. Positions are quoted from the mailing-list record or, where we could not open it, from the named trade report.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Linux kernel, merge commit 330517c63aa9: char-misc-7.4-rc1 (Greg Kroah-Hartman, merged by Linus Torvalds)](https://github.com/torvalds/linux/commit/330517c63aa9) — 24 October 2026
2. [Linux kernel, commit eafedbc7c050: rust_binder: add Rust Binder driver (Alice Ryhl, Google)](https://github.com/torvalds/linux/commit/eafedbc7c050c44744fbdf80bdf3315e860b7513) — 19 September 2025
3. [Google Security Blog, Memory Safe Languages in Android 13](https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html) — 1 December 2022
4. [Google Security Blog, Eliminating Memory Safety Vulnerabilities at the Source](https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html) — 25 September 2024
5. [Google (Jeff Vander Stoep), Rust in Android: move fast and fix things](https://blog.google/security/rust-in-android-move-fast-fix-things/) — 13 November 2025
6. [The Chromium Projects, Memory safety (912 high or critical bugs since 2015)](https://www.chromium.org/Home/chromium-security/memory-safety/) — undated page
7. [CVE-2025-68260, rust_binder: fix race condition on death_list](https://cveawg.mitre.org/api/cve/CVE-2025-68260) — 16 December 2025
8. [Linux kernel, commit 30d15f44a9e5: binderfs: fix UAF write in binder_add_device](https://github.com/torvalds/linux/commit/30d15f44a9e5) — 16 September 2026
9. [LWN.net, Resistance to Rust abstractions for DMA mapping](https://lwn.net/Articles/1006805/) — 30 January 2025
10. [The Register, Linux royalty backs adoption of Rust for kernel code, says its rise is inevitable](https://www.theregister.com/2025/02/21/linux_c_rust_debate_continues/) — 21 February 2025
11. [Phoronix, New Linux Patch Confirms: Rust Experiment Is Done, Rust Is Here To Stay](https://www.phoronix.com/news/Rust-To-Stay-Linux-Kernel) — 12 December 2025
12. [The Register, Rust-style safety model for C++ 'rejected' as profiles take priority](https://www.theregister.com/2025/09/16/safe_c_proposal_ditched/) — 16 September 2025
13. [CISA and FBI, Product Security Bad Practices, version 2](https://www.cisa.gov/resources-tools/resources/product-security-bad-practices) — 17 January 2025
14. [StatCounter Global Stats, Mobile operating system market share, India](https://gs.statcounter.com/os-market-share/mobile/india) — September 2026 data
15. [Android Security Bulletins overview (publication schedule; October bulletin 5 October 2026)](https://source.android.com/docs/security/bulletin/asb-overview) — 5 October 2026
16. [kernel.org, Linux 7.3 release](https://www.kernel.org/) — 18 October 2026

Related on TechBag: the [UEM and MDM guide](https://www.thetechbag.com/browse/endpoint-management/uem-mdm), the [vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) and the [developer tools guide](https://www.thetechbag.com/browse/devops/developer-tools).

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [UEM and MDM guide](https://www.thetechbag.com/browse/endpoint-management/uem-mdm) — where an Android fleet's patch level is tracked
- [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — how memory-corruption flaws are found and prioritised
- [Developer tools guide](https://www.thetechbag.com/browse/devops/developer-tools) — the toolchain side of a memory-safety roadmap