Linux Kernel Drops strncpy After Six Years: What Server Admins Need to Know

If you manage Linux servers, there’s a change coming in kernel 7.2 that you should put on your radar — even though it won’t break anything directly, it’s one of those quiet infrastructure improvements that makes the whole ecosystem a little harder to exploit.

After six years of work and over 360 individual patches, the Linux kernel has officially eliminated strncpy.

What Was strncpy and Why Remove It?

strncpy is a C standard library function that copies one string into a buffer. It’s been part of C since forever — and it’s been a source of security headaches for almost as long.

The problem is subtle but serious. strncpy doesn’t guarantee null-termination when the source string is longer than the destination buffer. This means if a developer isn’t careful (and humans rarely are, at scale), you end up with unterminated strings that can leak memory contents, cause crashes, or worse — open the door to buffer overflow exploits.

The kernel developers have been migrating away from strncpy since around 2020, replacing it with strscpy, a safer alternative that always null-terminates and returns an error code when the buffer is too small.

360 Patches Is a Lot of Cleanup

The scale of this effort is worth appreciating. Over 360 patches, spread across six years, touching drivers, filesystems, networking code, and core kernel subsystems. Every single call site had to be audited, replaced, and tested.

That’s not the kind of change that happens by accident. It requires sustained commitment from kernel maintainers who understand that security is a cumulative property — built one API replacement at a time.

What This Means for Your Servers

Short term: nothing breaks. If you’re running an older kernel, strncpy still exists. If you upgrade to 7.2, the kernel simply uses strscpy everywhere.

The real impact is indirect but meaningful:

• Fewer attack surfaces: Buffer overflow bugs in kernel code are among the most serious vulnerabilities an attacker can exploit. Removing the function that causes them is a structural improvement.
• Cleaner driver code: Third-party kernel modules and out-of-tree drivers that copy the kernel’s patterns will gradually adopt the same safer approach.
• A precedent for other projects: The Linux kernel is one of the largest C codebases in the world. When it removes a standard library function from its internal API, other projects notice.

Before You Upgrade

If you’re planning to move to Linux 7.2, here’s the practical checklist:

1. Test out-of-tree modules: Any custom kernel module that uses strncpy will need to switch to strscpy before it compiles against the 7.2 headers. This is the only thing that could actually break.
2. Review DKMS builds: If you use DKMS for things like NVIDIA drivers, VirtualBox modules, or custom filesystem drivers, make sure they’re updated for 7.2 compatibility.
3. Check your monitoring: Some security scanning tools flag strncpy usage in kernel modules as a finding. After upgrading, those scans should come back clean — which is good, but make sure your team understands why.

The Bigger Picture

This is the kind of change that doesn’t make headlines outside of kernel development circles, but it’s exactly the sort of long-horizon security work that keeps Linux viable as an operating system for everything from embedded devices to cloud infrastructure.

Most server admins won’t notice anything different after upgrading. That’s the point. The kernel got quietly, structurally safer.