Possible scope update for RUSTSEC-2026-0197 (cgmath swap_columns/swap_elements)

Possible scope update for RUSTSEC-2026-0197

Not proposing a new advisory — flagging that RUSTSEC-2026-0197's current
[affected.functions] and description may be narrower than the actual bug,
in case the affected-scope wording is worth revising. Deferring to
maintainer judgment on whether/how to update it.

The advisory currently says:

When a == b, these safe APIs create two mutable references to the same
matrix column and pass them to ptr::swap.

and lists only Matrix{2,3,4}::swap_columns as affected.

What I found doing an independent Miri sweep (posted in more detail as a
comment on the originating issue):

1. swap_columns is UB for any two indices, not just a == b. m.swap_columns(0, 1) on Matrix2, m.swap_columns(0, 2) on Matrix3, and m.swap_columns(1, 3) on Matrix4 — genuinely distinct columns in all three, all advisory-listed functions — abort under Miri with the same Stacked Borrows violation as the reported a == b case.
2. The same unsafe { ptr::swap(...) } pattern also exists in Matrix::swap_elements and Array::swap_elements (not currently listed in [affected.functions]), and is reachable through ordinary API use — Matrix2::transpose_self() calls swap_elements internally and reproduces the identical UB without the caller ever naming swap_columns/swap_elements directly.

Full repros, Miri output, and versions are in the linked comment on rustgd/cgmath#565 rather than duplicated here.

This doesn't change the fix recommendation (RUSTSEC-2026-0197 already correctly says swap_columns is unsound) — it's about whether [affected.functions] and the description undersell the actual reach of the bug (limited to a == b, three named functions) versus what's actually reproducible (any index pair, plus two more functions with the identical pattern). Happy to be told this is already the intended scope and the advisory is fine as-is.

Read the current RUSTSEC-2026-0197 advisory and the linked comment on rustgd/cgmath#565, including the Miri repros and output. Confirm whether the scope includes all index pairs and swap_elements paths; done means updating the advisory's affected.functions and description only if maintainer review accepts those findings.