Possible scope update for RUSTSEC-2026-0197
Not proposing a new advisory — flagging that RUSTSEC-2026-0197's current
[affected.functions] and description may be narrower than the actual bug,
in case the affected-scope wording is worth revising. Deferring to
maintainer judgment on whether/how to update it.
The advisory currently says:
When a == b, these safe APIs create two mutable references to the same
matrix column and pass them to ptr::swap.
and lists only Matrix{2,3,4}::swap_columns as affected.
What I found doing an independent Miri sweep (posted in more detail as a
comment on the originating issue):
swap_columns is UB for any two indices, not just a == b. m.swap_columns(0, 1) on Matrix2, m.swap_columns(0, 2) on Matrix3, and m.swap_columns(1, 3) on Matrix4 — genuinely distinct columns in all three, all advisory-listed functions — abort under Miri with the same Stacked Borrows violation as the reported a == b case.- The same
unsafe { ptr::swap(...) } pattern also exists in Matrix::swap_elements and Array::swap_elements (not currently listed in [affected.functions]), and is reachable through ordinary API use — Matrix2::transpose_self() calls swap_elements internally and reproduces the identical UB without the caller ever naming swap_columns/swap_elements directly.
Full repros, Miri output, and versions are in the linked comment on rustgd/cgmath#565 rather than duplicated here.
This doesn't change the fix recommendation (RUSTSEC-2026-0197 already correctly says swap_columns is unsound) — it's about whether [affected.functions] and the description undersell the actual reach of the bug (limited to a == b, three named functions) versus what's actually reproducible (any index pair, plus two more functions with the identical pattern). Happy to be told this is already the intended scope and the advisory is fine as-is.
Possible scope update for RUSTSEC-2026-0197
Not proposing a new advisory — flagging that
RUSTSEC-2026-0197's current[affected.functions]and description may be narrower than the actual bug,in case the affected-scope wording is worth revising. Deferring to
maintainer judgment on whether/how to update it.
The advisory currently says:
and lists only
Matrix{2,3,4}::swap_columnsas affected.What I found doing an independent Miri sweep (posted in more detail as a
comment on the originating issue):
swap_columnsis UB for any two indices, not justa == b.m.swap_columns(0, 1)onMatrix2,m.swap_columns(0, 2)onMatrix3, andm.swap_columns(1, 3)onMatrix4— genuinely distinct columns in all three, alladvisory-listed functions — abort under Miri with the same Stacked Borrows violation as the reporteda == bcase.unsafe { ptr::swap(...) }pattern also exists inMatrix::swap_elementsandArray::swap_elements(not currently listed in[affected.functions]), and is reachable through ordinary API use —Matrix2::transpose_self()callsswap_elementsinternally and reproduces the identical UB without the caller ever namingswap_columns/swap_elementsdirectly.Full repros, Miri output, and versions are in the linked comment on
rustgd/cgmath#565rather than duplicated here.This doesn't change the fix recommendation (
RUSTSEC-2026-0197already correctly saysswap_columnsis unsound) — it's about whether[affected.functions]and the description undersell the actual reach of the bug (limited toa == b, three named functions) versus what's actually reproducible (any index pair, plus two more functions with the identical pattern). Happy to be told this is already the intended scope and the advisory is fine as-is.