Google retires the C Binder driver in favor of its Rust rewrite
On September 18, 2026, Google submitted the patch that removes 11,000 lines of the C Binder driver, replaced by the Rust version upstreamed in Linux 6.18 and slated for Linux 7.4. It is the first time a major kernel driver moves entirely to Rust.
September 18, 2026. Google engineer Carlos Llamas submits the patch that removes the 11,000 lines of the C Binder driver. Linux 6.18. The Rust rewrite of that same driver had been upstreamed. Linux 7.4. The C code removal is slated for this merge window. Why it matters: it is the first time a major Linux kernel driver is replaced entirely by a Rust version — and the argument put forward is not only security but maintainability.
Binder, the invisible plumbing of Android
Binder is the inter-process communication (IPC) mechanism that has powered Android from the start. Every app, every system service, every notification crossing from one process to another flows through it. Inside the kernel it is one of the most heavily exercised character drivers: billions of calls per day on every phone in the field.
For over fifteen years, that driver was written in C. It grew alongside Android’s evolution, accumulating fixes, optimizations, and execution paths that became ever more tangled. The word Carlos Llamas picks in his patch message is not “dangerous” but “painful”: the C code became “incredibly painful to maintain”, hard to extend “without tripping over vulnerabilities”.
That is the heart of the story. Binder is not an abandoned, exotic driver: it is a critical, ubiquitous, and old component. Those are precisely the three properties that make a C driver hard to maintain — every new feature must be added without breaking invariants nobody fully holds anymore.
The switch: yank the C, crown the Rust
The Rust rewrite did not come from nowhere. It is the work of several years by the Rust-for-Linux team, led in large part by Alice Ryhl. The Binder driver in Rust was upstreamed in Linux 6.18, marking one of the first incursions of a “real” driver written in the language into the mainline kernel.
Carlos Llamas’s patch message is blunt: “The day has finally come. We are dropping the legacy C implementation of the Binder IPC driver in favor of its Rust version.” He notes that Alice Ryhl not only achieved full feature parity but also proved the Rust version can match and often beat the C counterpart’s performance. The driver has run on real Android devices for some time — which, he writes, means it can no longer be called an “experiment”.
The patch removing the 11,000 lines of C was picked up by Greg Kroah-Hartman into the char-misc-next branch, which lines it up for the Linux 7.4 merge window. In other words, the removal is not a wish: it is already in the kernel’s official pipeline.
Rust-for-Linux, the long road here
The Binder switch does not come out of nowhere: it is the culmination of a multi-year effort under the name Rust-for-Linux. The first abstractions — safe layers that wrap the kernel’s internal APIs in Rust types — entered the mainline kernel from Linux 6.1 onward. Since then, progress has been slow and cautious: every new abstraction must be signed off by maintainers who want to be sure the language does not become a second source of bugs.
The Rust Binder driver is one of the first “real” uses of those abstractions. Unlike an experimental module, it had to cover complete behavior — every Android IPC path — with a performance bar comparable to C. It is that requirement, plus the fact that it runs in production on phones, that now gives Google the confidence to pull the C code.
The real issue: maintainability, not just memory
The argument most often made for Rust in the kernel is memory safety — eliminating, at compile time, whole classes of bugs such as use-after-free, buffer overflows, and data races. Binder has a history of vulnerabilities in exactly that register, such as CVE-2019-2215, a use-after-free exploited in the wild.
But Google’s message foregrounds a less spectacular, more structural benefit: maintainability. A Rust driver forces ownership and lifetime invariants to be expressed explicitly in the type system. Adding a feature no longer means guessing which implicit C invariants must not be violated: the compiler checks them. That is what lets the team “focus all new features and optimizations” instead of spending its time avoiding breakage.
The nuance matters. Rust does not eliminate logic bugs — a bad access policy is still a bad access policy. But it removes from the path the class of errors that historically supplied most of the kernel’s exploitable vulnerabilities. And it makes the cost of maintenance predictable, which is exactly what a fifteen-year-old driver had stopped being.
What it changes for the kernel
Binder is not the first Rust code in the kernel — other drivers and abstractions have trickled in since Linux 6.1. But it is the first case of a complete replacement of a major C driver by its Rust rewrite, with a public argument of parity and performance. It is a precedent: it offers a reproducible model for other aging critical drivers.
For an administrator, the concrete translation is simple. On Android, nothing changes from the user’s point of view — the driver is already in production. On distributions that build the kernel, the question that will arise from Linux 7.4 onward is the availability of Rust bindings in the toolchain, because a kernel that enables Binder will now have to compile Rust. Local verification is a single command:
# Check whether the running kernel ships the Binder driver and its Rust variant
grep -E 'CONFIG_ANDROID_BINDER|CONFIG_RUST' /boot/config-$(uname -r) 2>/dev/null || \
grep -E 'CONFIG_ANDROID_BINDER|CONFIG_RUST' /proc/config.gz 2>/dev/null | zcatThe underlying trend is broader than Binder. The Linux kernel is absorbing Rust driver by driver, at a measured but now irreversible pace. Binder is its first large-scale demonstration on a critical component.
Verdict
The retirement of the C Binder driver for Linux 7.4 is not an engineering anecdote: it is the first proof, in the mainline kernel, that Rust can replace a production C driver at parity of features and performance, with maintainability stated as the central argument. If you maintain kernels for Android devices or embedded systems, prepare your toolchain for Rust bindings before the 7.4 window. If you track kernel evolution, mark the date: Binder is the first major driver to move entirely to Rust — and it will not be the last.