Nvidia launches CUDA Rust with two open-source projects for writing compile-time safe kernels

Nvidia has announced CUDA Rust, making Rust a first-class language for writing GPU kernels. Until now Rust code could only launch kernels; the kernel body itself had to be written in another language. Two open-source projects from NVlabs close the gap: cuda-oxide for the SIMT model and cutile-rs for the newer Tile model. Both compile Rust kernels natively and use the language's ownership rules to reject aliasing bugs at compile time.

Why now? The AI systems layer — from inference engines through drivers to agent runtimes — is increasingly written in Rust. Nvidia's Nova Linux driver is already in Rust, Dynamo has a Rust core, and NVTX has Rust bindings. The GPU kernel remained the sole exception. The two tracks mirror the two programming models CUDA already offers: SIMT, the classic model where you describe what one thread does and launch thousands of them, and Tile, the newer model where you describe what one data tile does and the Tile IR compiler handles thread mapping and memory layout. Nvidia recommends starting with Tile and reserving SIMT for cases that demand explicit control over threads and memory. Planned cross-language interoperability ensures that choosing Rust will not lock developers out of C++ or Python.

First track: cuda-oxide

cuda-oxide is a custom codegen backend for rustc. It routes functions marked with #[kernel] through Rust's MIR, through the community Pliron framework, through LLVM IR and down to PTX (Nvidia's assembly), while passing the rest of the code to the standard backend. Nvidia wrote the GPU dialects on top of Pliron. Requirements: Linux, GPU with compute capability 8.0 or higher, CUDA 12.x or higher, clang with libclang, and a pinned nightly toolchain (nightly-2026-04-03). The command cargo oxide doctor checks the environment, and cargo oxide new generates a vector-add skeleton with host and device code in a single file. The safety argument lives in the kernel signature: inputs a and b are ordinary shared slices, but output c is a DisjointSlice<f32>, a type that gives each thread exclusive access to its own element. A plain &mut [f32] would require every thread to hold a mutable reference to the same memory, which Rust's borrow checker rejects. c.get_mut(idx) returns an Option, so out-of-bounds access becomes a handled branch. The #[launch_contract] attribute declares the block shape, and the auto-generated prepare_vecadd method validates the launch configuration against it before the safe launch.

Second track: cutile-rs

cutile-rs operates one level up. Each tile block runs the kernel body once as a single logical thread over a sub-tensor, and the compiler decides how many real GPU threads will back it. The #[cutile::module] macro embeds the kernel AST in the host binary and JIT-compiles via CUDA Tile IR on first launch. Requirements are lighter: compute capability 8.0 or higher, CUDA 13.3, stable Rust 1.89 or higher, and Linux — no nightly, no custom LLVM. Setup is cargo new followed by cargo add cutile. The host-side call partition([128]) does three things: gives each tile exclusive ownership of its 128-element chunk, sets the grid to 1,024 / 128 = 8 tiles, and supplies the fixed tile width B. Input tensors use 1 as a dynamic dimension resolved at launch. The generated launcher takes ownership of all tensors and returns them when the GPU finishes. Nothing runs until .sync_on(&stream); everything before that is a lazy description recorded in a single chain.

What the compiler catches

Passing a SIMT kernel's output buffer as one of its own inputs fails with error[E0502]: cannot borrow c_dev as mutable because it is also borrowed as immutable. The same aliasing on the Tile side fails with error[E0382]: use of moved value. In both cases the bug is caught at compile time, not at runtime on the GPU.

Status: alpha, not production

Both projects are in alpha and not approved for production. cutile-rs is already published on crates.io, runs on stable Rust 1.89 or higher, and is used in Hugging Face's Grout inference engine and in mistral.rs. cuda-oxide remains early alpha and requires a pinned nightly toolchain.