Red Hat issued a security advisory (RHSA-2025:20983) for podman, a container management tool part of the libpod library. The advisory addresses two vulnerabilities: CVE-2025-47907, a race condition in the Postgres Scan within database/sql, and CVE-2025-9566, where the podman kube play command may overwrite host files. These vulnerabilities affect multiple architectures and variants of Red Hat Enterprise Linux 10 and CodeReady Linux Builder. The advisory provides updated packages to fix these issues. No CVSS score is included in the advisory, and no exploits are known to be active in the wild. The vendor rates the update as Important and recommends applying the update as described in their official guidance.

The vulnerabilities could lead to unintended overwriting of host files via the podman kube play command and a race condition in Postgres scanning, potentially causing data corruption or unauthorized file modifications. The advisory does not provide detailed impact metrics or CVSS scores but classifies the update as Important, indicating a significant security risk if unpatched. No known exploits in the wild have been reported at this time.

Red Hat has released updated podman packages for Red Hat Enterprise Linux 10 and related products that address these vulnerabilities. Users should apply the official updates as detailed in Red Hat's advisory (https://access.redhat.com/articles/11258) to remediate the issues. Since this is an official fix, applying the vendor-provided update is the recommended mitigation. Patch status is confirmed as available via the vendor advisory.