Linux has kernel panics, and they predate Rust. You can't just dereference NULLs or spray random memory and still "absolutely avoid crashes". If you let C code

Linux has kernel panics, and they predate Rust. You can't just dereference NULLs or spray random memory and still "absolutely avoid crashes". If you let C code write past end of a vector, you will have an unstable system and data corruption. Catching these bugs before they cause damage is an improvement to stability. In Rust you can compartmentalize panics. Instead of messing up the whole kernel or causing a machine-halting kernel panic, you can gracefully unwind one call and execute a fallback or return an error code from the one syscall that hit the bug. That is how you can continue running the kernel reliably instead of hoping to get lucky. Then, there was a miscommunication between the Linux Rust project and Linus, about an issue that does not exist any more. An early draft had a handler that translated OOM to kernel panics as a kludge from use of Rust's standard library containers as a placeholder for proper containers being developed. Linus rightly criticized that this was a bad idea, but it was never meant to be the final setup. That code has been replaced now, and Rust in the kernel uses fallible allocation that does not abort nor panic. The issue does not exist in the no-alloc Rust dialect used in the kernel going forward.