This vulnerability (CVE-2025-9648) is a race condition in the database/sql package used by Red Hat Advanced Cluster Security for Kubernetes. When a query is cancelled during a Scan method call on returned Rows, concurrent queries can produce unexpected results, causing inconsistent data to be returned. The issue is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-158. Red Hat has released a security advisory (RHSA-2025:22179) with updated images for RHACS 4.8.6 that include fixes for this and other issues. The vulnerability is rated moderate severity by Red Hat, with no known exploits in the wild. The advisory recommends upgrading to the fixed versions to mitigate the issue.

The vulnerability can cause applications that cancel queries during concurrent database operations to receive inconsistent or unexpected data. While it may lead to data inconsistency, the scope of exploitation is limited and unlikely to result in direct system compromise in typical deployments. There are no known exploits in the wild. The impact is primarily on data integrity and application stability rather than confidentiality or availability.

Red Hat has released updated images as part of RHSA 4.8.6 that include fixes for this vulnerability. Users of Red Hat Advanced Cluster Security for Kubernetes are advised to upgrade to the fixed versions mentioned in the advisory to benefit from the security patches. No additional mitigations are specified or required beyond applying the official update.