Ubuntu 25.10 ‘Questing Quokka’ brings new security tools to the Linux desktop. The distribution is the first to use Rust-based implementations of sudo and coreutils by default, while TPM-backed full disk encryption provides additional protection.
Ubuntu 25.10 introduces experimental support for TPM-backed Full Disk Encryption. This technology uses the Trusted Platform Module chip to store cryptographic keys for hard disk encryption. The system makes data completely inaccessible without the correct key during boot.
The implementation provides support for password management, recovery key regeneration, and better integration with firmware updates. Canonical warns that the feature is not yet suitable for production environments, but users with a security background can already test the technology.
In addition, Network Time Security (NTS) is enabled by default. NTS adds a cryptographic layer to time synchronization to prevent man-in-the-middle attacks.
Rust tackles critical system tools
Canonical is undergoing a major shift with Ubuntu 25.10. The distribution is replacing traditional tools with memory-safe Rust alternatives. The new sudo-rs takes over the role of the classic sudo command, while uutils replaces the GNU coreutils.
Memory safety bugs account for a large proportion of all security issues in software. By rewriting critical system components in Rust, Canonical is significantly reducing the attack surface. “We see sudo-rs as a major step forward for Ubuntu’s overall security posture,” said Jon Seager of Canonical.
Users who depend on specific sudo functionality can still fall back on the traditional implementation. Canonical wants to gather feedback before sudo-rs is definitively included in Ubuntu 26.04 LTS.
Developer tools get update
The new release includes the latest versions of popular development tools. OpenJDK 25 replaces older Java implementations, while Python 3.14 RC3, Golang 1.25, and GCC 15 are also included. Rust ships version 1.85 by default, with 1.88 available as an alternative.
A preview of the Zig compiler debuts for amd64 and arm64 architectures. .NET 10, the upcoming LTS version due out in November, also gets a preview in Ubuntu 25.10.
Canonical has also improved the .NET Snapcraft plugin for better support of monorepo setups. PowerShell tools are now available for arm64, ppc64el, and s390x platforms via the PowerShell snap.
Linux kernel 6.17 brings support for nested virtualization on Arm architecture. This functionality allows cloud providers and developers to run hypervisors within virtual machines. Platforms such as Nvidia Grace and AmpereOne can use this to implement advanced CI/CD pipelines and flexible test environments.