The read-only dmg block driver can crash or leak information when it encounters
a malicious DMG file. The severity of these issues is low because the block
driver is used in qemu-img convert workflows where there is no sensitive
information to leak and crashing is a self-DoS.

See the individual patches for descriptions of the bugs.

Stefan Hajnoczi (3):
  dmg: fix out-of-bounds load in search_chunk() (CVE-2026-65929)
  dmg: refuse to open files with no chunks
  dmg: reject inconsistent UDRW chunk sector count and length
    (CVE-2026-65928)

 block/dmg.c | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

-- 
2.55.0