NVIDIA has announced CUDA Rust, a push to make Rust a first-class language for writing GPU kernels. Rust code could already launch CUDA kernels, but the kernel body usually had to be written elsewhere. CUDA Rust closes that gap with two NVlabs open-source projects: cuda-oxide for the SIMT model and cutile-rs for the newer Tile model. Both compile Rust kernels natively and use Rust’s ownership rules to reject aliasing bugs at compile time.

Is it deployable? Partially. cutile-rs is published on crates.io, runs on stable Rust 1.89+, and is already used in Hugging Face’s Grout inference engine and in mistral.rs. cuda-oxide is early alpha. The both projects are in alpha phase and not confirmed for production.

Why Rust for the GPU Kernel

The systems layer of AI, from inference engines to drivers and agent runtimes, is increasingly written in Rust. NVIDIA’s Nova Linux driver is in Rust, NVIDIA Dynamo has a Rust core, and NVTX has Rust bindings. The GPU kernel was the exception.

The two tracks mirror the two programming models CUDA already offers. SIMT is the model used in CUDA C++ and numba-cuda: you describe what one thread does and launch thousands of them. Tile is the newer model, also available in C++ and Python: you describe what one tile of data does, and the Tile IR compiler handles thread mapping and memory layout. NVIDIA recommends Tile first, with SIMT for explicit thread and memory control. Planned inter-language interop means choosing Rust will not lock developers out of C++ or Python.

The SIMT Track: cuda-oxide

cuda-oxide is a custom rustc codegen backend. It routes #[kernel] functions through Rust MIR, the community Pliron IR framework, and LLVM IR down to PTX, then hands everything else to the standard backend. NVIDIA wrote the GPU dialects on top of Pliron.

Requirements: Linux, a GPU with compute capability 8.0 or later, CUDA 12.x or newer, clang with libclang, and a pinned nightly toolchain (nightly-2026-04-03). cargo oxide doctor checks the setup and cargo oxide new scaffolds a vector addition program, with host and device code in one file.

The safety argument sits in the kernel signature. Inputs a and b are ordinary shared slices. The output c is a DisjointSlice, a type that gives each thread exclusive access to its own element. A plain &mut [f32] would need every thread to hold the same mutable borrow, which Rust refuses. c.get_mut(idx) returns an Option, so out-of-bounds access becomes a handled branch. A #[launch_contract] attribute declares the block shape, and the generated prepare_vecadd method validates the launch configuration against it before the safe launch runs.

The Tile Track: cutile-rs

cutile-rs works one level higher. Each tile block runs the kernel body once as a single logical thread over one sub-tensor, and the compiler decides how many real GPU threads back it. The #[cutile::module] macro embeds the kernel’s AST in the host binary and JIT-compiles it through CUDA Tile IR when the kernel is first launched.

Requirements are lighter: compute capability 8.0 or later, CUDA 13.3, stable Rust 1.89 or newer, and Linux, with no nightly and no custom LLVM. Setup is cargo new, then cargo add cutile.

The host-side .partition([128]) call does 3 jobs. It gives each tile exclusive ownership of its 128-element chunk, fixes the grid at 1,024 / 128 = 8 tiles, and supplies the const tile width B. Input tensors use -1 as a dynamic dimension resolved at launch. The generated launcher takes ownership of all tensors and returns them when the GPU finishes. Nothing executes until .sync_on(&stream); everything before it is a lazy description recorded in one chain.