A patch that landed for Linux kernel 7.3 changes how two features interact: RandStruct, a hardening feature that randomizes the memory layout of sensitive kernel data structures to make certain exploits harder, and Rust for Linux, the in-progress effort to allow kernel code and drivers to be written in Rust. Kernel developer Mark Brown's patch, titled "hardening: Default randstruct off with rust for better allmodconfig support," flips the previous Kconfig dependency so that enabling Rust no longer requires RandStruct to be disabled by the builder — instead, RandStruct now defaults off automatically when Rust is on.
Phoronix reported the change plainly: Linux 7.3 now disables the RandStruct security feature by default whenever Rust support is present in the build, a reversal driven by the fact that randstruct does not yet support Rust code.
Why it matters
Allmodconfig — a build configuration that enables essentially every optional kernel module — is the kernel project's standard way of catching build breakage across the huge surface of driver and subsystem code before changes reach users. Before this patch, the Kconfig dependencies meant enabling Rust support could conflict with RandStruct being on, so allmodconfig test builds run by the kernel's continuous integration systems weren't reliably exercising Rust code, undermining the point of routine build coverage.
The change highlights a real cost of integrating Rust into a 30-year-old C codebase: some existing hardening tooling was written with assumptions specific to C's memory layout and struct handling, and getting Rust code paths properly covered by kernel-wide testing means those tools have to be updated or, in the interim, selectively turned off.
How it works
The patch went through at least four revisions on the kernel and kernel-hardening mailing lists between July and September 2026, cc'd to hardening maintainer Kees Cook and Rust for Linux lead Miguel Ojeda among others, indicating it was reviewed across both the security-hardening and Rust maintainer groups before merging.
Separately, Ojeda's own pull requests for Rust support in 7.3 describe ongoing fixes and note early work toward supporting Rust's GCC-based compiler backend (rustc_codegen_gcc), a parallel effort to reduce the kernel's current reliance on a specific version of the upstream Rust compiler toolchain.
The competing read
From the Rust-for-Linux side, this is a reasonable, temporary trade-off: better to have full build coverage of Rust code with one security hardening feature off by default than to have RandStruct on but Rust code going largely untested in the project's standard CI configuration. Kernel developers who prioritize hardening might see it differently — disabling a security mitigation by default, even conditionally, is a regression for any system that both wants RandStruct's protections and happens to build with Rust support enabled, which is an increasing share of default configurations on newer kernels as more subsystems adopt Rust.
The webpronews summary of the change described it explicitly as forcing a trade-off on a core security feature, framing the build-coverage justification against the loss of a hardening mitigation for affected configurations.
What happens next
The dependency is described as a workaround pending proper RandStruct support for Rust code, meaning kernel hardening maintainers still have follow-up work to make the two features compatible rather than mutually exclusive. As Rust's footprint in the kernel keeps expanding — into more drivers and, eventually, discussions around core subsystems — more of these C-tooling-versus-Rust compatibility gaps are likely to surface, and how quickly the community closes them will shape how fast distributions feel comfortable turning Rust support on by default in production kernels.