Bar Chart Trolls Rust: More Kernel CVEs Per Million Lines Than C

Description

A matplotlib-style bar chart titled 'Linux Kernel CVEs Per Million Lines of Code' comparing two bars: Rust (orange bar, Rust gear logo watermark) at 8.33, and C (gray bar, hexagonal C logo watermark) at 5.53, on a y-axis from 0 to 10. The chart appears designed to provoke the Rust-vs-C memory-safety debate by showing Rust with a higher CVE density in the Linux kernel than C. The statistical bait is the denominator: the kernel contains tens of millions of lines of mature, battle-hardened C versus a tiny, brand-new Rust footprint, so even a handful of Rust CVEs yields a huge per-million-LOC rate - a textbook small-sample / base-rate fallacy weaponized for language-war engagement

Common Tags

Rust LinuxKernelDevelopment MemorySafety CVE CommonVulnerabilitiesAndExposures LanguageWars Linux CFamilyLanguages MisinterpretationOfData DataVisualization SecurityVulnerabilities

Comments

Anonymous ★ Top Pick With ~30 million lines of C and a rounding error of Rust in the kernel, this chart proves only one vulnerability: dividing by a small denominator

Anonymous ★ Top Pick

With ~30 million lines of C and a rounding error of Rust in the kernel, this chart proves only one vulnerability: dividing by a small denominator
Anonymous

The safest component in this chart is the missing confidence interval.
@zaspirin 6mo

Blazing fast CVE accumulation 🚀🚀🚀
@OrkWard 6mo

source?
1. @tuguzT 6mo
  
  "I made it up" wait for it
2. @SamsonovAnton 6mo
  
  Open source, of course! 📱🤓
@LonelyGayTiger 6mo

I'm pretty sure there's all of exactly one rust CVE, and it's just DOS.
1. @OrkWard 6mo
  
  Sound fair, so there are about 120,000 loc of rust in kernel src tree (probably less then 1% of c)
  
  @LonelyGayTiger 6mo
  
  Looks like as of this time last year it was about 20k lines of Rust. Google's AI summary claims 25k, but doesn't cite any sources.
@LonelyGayTiger 6mo

And yeah, the kernel treats all crashes as DOS CVEs, so it's not even like the one Rust CVE is actually a problem. Not a real security risk.
@volkov_s 6mo

Probably 1 line of Rust carries more actual logic than 1 line of C
1. @nwordtech 6mo
  
  You can put way more unwraps on single line of rust code
2. @GioMetal 2mo
  
  that is because the real work is abstracted or people like you cry :(
@H3R3T1C 6mo

1 of 2 is 50%..... 5 of 100 is 5%
@Agent1378 6mo

Hahahahahahshshaaaaaa
@q_rsqrt 6mo

gotta apply that wd-40
@hkalbasi 6mo

Linux had 3k CVEs just in 2025, so unless it has 1B lines of C code, this is wrong
@qtsmolcat 5mo

It's almost like rust is a tiny portion of the codebase or something

Use J and K for navigation

Bar Chart Trolls Rust: More Kernel CVEs Per Million Lines Than C

Description

Categories

Common Tags

Comments

More like this

Rust vs HTML5 Memory Safety Comparison Table

Rewrite Postgres in Rust, Then Look Forward to Death

Zig Declines to Collect Bun's Garbage