CVE-2025-47907 is a race condition vulnerability in the database/sql package used by the multicluster engine for Kubernetes. When a query is cancelled during a Scan method call on returned Rows, concurrent queries can produce unexpected results due to a race condition. This can lead to inconsistent data being returned to the application. The vulnerability affects multicluster engine for Kubernetes versions >=2.9.0 and <2.9.2. Red Hat has issued a security update in version 2.9.2 to fix this issue. The flaw is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and related CWEs indicating race conditions and resource exhaustion. The vulnerability is rated as high severity by Red Hat but is noted to have limited exploitation scope and is unlikely to result in direct compromise in typical deployments.

The vulnerability can cause inconsistent data to be returned to applications using the affected multicluster engine for Kubernetes versions. It arises from a race condition when queries are cancelled during concurrent Scan operations. While it may cause unexpected behavior and data inconsistency, it is unlikely to lead to direct system compromise or privilege escalation in most typical deployments. The impact includes potential denial of service due to resource exhaustion or instability, and confidentiality or integrity issues due to race conditions in data handling.

A fixed version 2.9.2 of the multicluster engine for Kubernetes has been released by Red Hat to address this vulnerability. Users should upgrade to version 2.9.2 or later to remediate the issue. No additional mitigations are specified or required beyond applying the official update.