Urgent: Regarding Fixing of Security Vulnerabilities

Urgent: Regarding Fixing of Security Vulnerabilities

[whyshall]

[-- Attachment #1: Type: text/plain, Size: 1623 bytes --]

 Hi ,

We are planning to migrate our product to the Linux Kernel 4.19.y CIP
release to benefit from its long-term maintenance and security updates.

We have a few questions regarding security vulnerability tracking for the
CIP kernel:

   1. Is there any tool, dashboard, or documentation available to determine:
      - The Kernel CVEs applicable to a specific 4.19.y CIP release.
      - Which CVEs have already been fixed till the given CIP release.
      - Which CVEs are still outstanding.
      2. Is there a published roadmap or policy indicating how unresolved
   Kernel CVEs are evaluated and scheduled for backporting to the 4.19.y CIP
   branch?
   3. For CVEs that remain unfixed in the CIP kernel:
      - What are the expected implications or risks for users of the CIP
      release?
      - Are these vulnerabilities typically already addressed in the
      upstream mainline Linux kernel, with backporting to CIP pending due to
      compatibility or maintenance considerations?
      4. If there are unfixed vulnerabilities that are considered critical
   for our product, what is the recommended approach to address them?


   - Does the CIP project provide any guidance or best practices for
      evaluating, backporting, or mitigating such vulnerabilities?
      - If a required fix is available only in the upstream mainline
      kernel, are there any recommendations or guidelines for safely
backporting
      it to the CIP kernel?

Any guidance on the recommended process or tools for tracking the security
status of CIP kernel releases would be greatly appreciated.

Thank you for your support.

[-- Attachment #2: Type: text/html, Size: 2998 bytes --]

Urgent: Regarding Fixing of Security Vulnerabilities

[whyshall.dev]

[-- Attachment #1: Type: text/plain, Size: 5900 bytes --]

Hi ,

We are planning to migrate our product to the Linux Kernel 4.19.y CIP release to benefit from its long-term maintenance and security updates.

We have a few questions regarding security vulnerability tracking for the CIP kernel:

* Is there any tool, dashboard, or documentation available to determine:

* The Kernel CVEs applicable to a specific 4.19.y CIP release.
* Which CVEs have already been fixed till the given CIP release.
* Which CVEs are still outstanding.

* Is there a published roadmap or policy indicating how unresolved Kernel CVEs are evaluated and scheduled for backporting to the 4.19.y CIP branch?
* For CVEs that remain unfixed in the CIP kernel:

* What are the expected implications or risks for users of the CIP release?
* Are these vulnerabilities typically already addressed in the upstream mainline Linux kernel, with backporting to CIP pending due to compatibility or maintenance considerations?

* 
If there are unfixed vulnerabilities that are considered critical for our product, what is the recommended approach to address them?

* 
Does the CIP project provide any guidance or best practices for evaluating, backporting, or mitigating such vulnerabilities?

* 
If a required fix is available only in the upstream mainline kernel, are there any recommendations or guidelines for safely backporting it to the CIP kernel?

Any guidance on the recommended process or tools for tracking the security status of CIP kernel releases would be greatly appreciated.

Also, we came across an opensource tool called *kernel-backport-checker* , which identifies *Linux kernel CVEs* that have been addressed through backported commits in a Git repository, filtered based on the kernel configuration. We executed this tool against the latest CIP release, cip-4.19.325-cip134.

The output generated by the tool is provided below:

./kernel-backport-checker.sh \
>         -s ../../linux-cip-4.19.325- cip134 \
>         -d ../linux \
>         -b ../linux-stable \
>         -e ../kev-data \
>         -f ../nvd-json-data-feeds \
>         -k ../../linux-cip-4.19.325- cip134/.config \
>         -o ../../linux-cip-4.19.325- cip134/cve_report -j 4
============================== ==========
Kernel Backport Checker v3.2.0
============================== ==========

[INFO] Configuration:
[INFO]   Kernel Source:   ../../linux-cip-4.19.325- cip134
[INFO]   Kernel Config:   ../../linux-cip-4.19.325- cip134/.config
[INFO]   Git Repository:  ../linux
[INFO]   Stable/Vendor:   ../linux-stable
[INFO]   KEV File:        ../kev-data/known_exploited_ vulnerabilities.json
[INFO]   NVD Feeds:       ../nvd-json-data-feeds
[INFO]   Output:          ../../linux-cip-4.19.325- cip134/cve_report
[INFO]   Parallel Jobs:   4

[INFO] Detecting kernel version...
[INFO] Kernel version: 4.19.325
[INFO] Loading kernel config: ../../linux-cip-4.19.325- cip134/.config
[INFO] Loaded 1752 enabled CONFIG options
[INFO] Building CONFIG mapping from kernel Makefiles...
[INFO] Built CONFIG mapping: 16301 file mappings, 1503 directory mappings
[INFO] Scanning NVD feeds for CVEs affecting Linux kernel 4.19.325...
[INFO]   Phase 1: Finding kernel CVE files...
[INFO]   Found 18117 CVE files with Linux kernel CPEs
[INFO]   Phase 2: Extracting version ranges (sequential to ensure accuracy)...
[INFO]   Extracted 155638 version entries
[INFO]   Phase 3: Filtering for version 4.19.325...
[INFO] NVD scan complete: 3600 CVEs affect kernel 4.19.325
[INFO] Extracting upstream fix commit hashes from NVD references (jobs=4)...
[INFO] Extracted 17487 fix commit refs for 3410 CVEs
[INFO] Building git hash index...
[INFO] Git hash index built: 1967640 commits
[INFO] Extracting backported CVE fixes from git...
[INFO] Searching stable/vendor repo for CVE mentions: ../linux-stable
[INFO] Found 4388 commit-CVE pairs (733 unique CVEs in git)
[INFO] Building CISA KEV index...
[INFO] KEV index built: 1631 CVEs
[INFO] Processing results...
[INFO]   Matching fix commits against git repos...
[INFO]   Found 17469 fix commits in git repos
[INFO]   Extracting changed files and diffs from fix commits (jobs=4)...
[INFO]   Exporting lookup tables for parallel processing...
[INFO]   Processing 3600 affected CVEs (jobs=4)...
[INFO]   Processing complete.
[INFO] Generating CSV report...
[INFO] ============================== =============
[INFO] Report: ../../linux-cip-4.19.325- cip134/cve_report/backport- report.csv
[INFO] ============================== =============
[INFO]
[INFO] Summary for kernel 4.19.325:
[INFO]   Total CVEs:              3600
[INFO]   Not applicable:          1718
[INFO]   Applicable:              1882
[INFO]     Fixed via backport:    73
[INFO]     Likely fixed (review): 32
[INFO]     Unfixed (remaining):   745
[INFO]     Inconclusive:          1032
[INFO]
[INFO]   CVEs in CISA KEV:        6 (fixed: 1)
[INFO]
[INFO]   Severity (applicable / unfixed):
[INFO]     CRITICAL:              21 / 5
[INFO]     HIGH:                  512 / 194
[INFO]     MEDIUM:                1327 / 538
[INFO]     LOW:                   22 / 8

[INFO] Done!

Why is this tool giving *Inconclusive* ?Will these ever be counted as vulnerabilities or not?
Also, the number of *unfixed CVEs* as per this tool are 745. This tool also generates the list of those unfixed CVEs in a .csv file.
Will these vulnerabilities *be resolved by CIP* in the next release or will it *take multiple releases* and hence more time to get solved? That is why I had asked whether CIP maintains a list of solved and unsolved vulnerabilities till date for 4.19.y-cip kernel !

We would appreciate your feedback on these results as well.

[-- Attachment #2: Type: text/html, Size: 47381 bytes --]

Re: [cip-dev] Urgent: Regarding Fixing of Security Vulnerabilities

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 980 bytes --]

Hi!

> We are planning to migrate our product to the Linux Kernel 4.19.y
>CIP release to benefit from its long-term maintenance and security
>updates.

Would you mind introducing yourself, your company, and your product?

Normally, we would recommend 6.12 kernel branch if you are doing the
migration, anyway.

> We have a few questions regarding security vulnerability tracking for the CIP kernel:
> 
> * Is there any tool, dashboard, or documentation available to determine:
> 
> * The Kernel CVEs applicable to a specific 4.19.y CIP release.
> * Which CVEs have already been fixed till the given CIP release.
> * Which CVEs are still outstanding.

Take a look at
git@gitlab.com:cip-project/cip-kernel/cip-kernel-sec.git .

> * If there are unfixed vulnerabilities that are considered critical
> for our product, what is the recommended approach to address them?

Approach is similar / same to what -stable kernels use.

Best regards,
								Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: Urgent: Regarding Fixing of Security Vulnerabilities

[whyshall]

[-- Attachment #1: Type: text/plain, Size: 2947 bytes --]

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------On Tue, Jul 14, 2026 at 02:39 AM, Pavel Machek wrote:

> 
> Would you mind introducing yourself, your company, and your product?
> - This is Vishal Maheshwari (Senior Research Engineer) from Center for
> Development of Telematics, Delhi, working on an embedded product based on
> Linux kernel 4.19.94.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

> 
> Normally, we would recommend 6.12 kernel branch if you are doing the
> migration, anyway.

- Can't port to this kernel as the driver support for a particular device in our board based on *Linux Kernel* *4.19.94* is missing in the *6.12.x* kernel and don't have the *expertise* to port the *driver(s)* to the *6.12.x series*. So,  can upgrade to *linux-cip-4.19.325-cipX* kernel only.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

> 
> Take a look at
> git@...:cip-project/cip-kernel/cip-kernel-sec.git .

Ok, will try to run this tool. Would this tool be able to list out *the solved and unsolved vulnerabilities* in *linux-cip-4.19.325-cipX* based on the *.config file* modified as per our board ?

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Also, will the CIP community not be solving all the vulnerabilities associated with the *4.19.325* reported by websites like cve.org, cvedetails.com, NVD databse etc in their repository *linux-cip* (repo link:- https://gitlab.com/cip-project/cip-kernel/linux-cip.git ) in *linux-4.19.y-cip branch* ?
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[-- Attachment #2: Type: text/html, Size: 3592 bytes --]

Re: Urgent: Regarding Fixing of Security Vulnerabilities

[whyshall]

[-- Attachment #1: Type: text/plain, Size: 2941 bytes --]

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------On Tue, Jul 14, 2026 at 02:39 AM, Pavel Machek wrote:

> 
> Would you mind introducing yourself, your company, and your product?
> - This is Vishal Maheshwari (Senior Research Engineer) from Center for
> Development of Telematics, Delhi, working on an embedded product based on
> Linux kernel 4.19.94.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

> 
> Normally, we would recommend 6.12 kernel branch if you are doing the
> migration, anyway.

- Can't port to this kernel as the driver support for a particular device in our board based on *Linux Kernel* *4.19.94* is missing in the *6.12.x* kernel and don't have the *expertise* to port the *driver(s)* to the *6.12.x series*. So,  can upgrade to *linux-cip-4.19.325-cipX* kernel only.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

> 
> Take a look at
> git@...:cip-project/cip-kernel/cip-kernel-sec.git .

Ok, will try to run this tool. Would this tool be able to list out *the solved and unsolved vulnerabilities* in *linux-cip-4.19.325-cipX* based on the *.config file* modified as per our board ?

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Also, will the CIP community not be solving all the vulnerabilities associated with the *4.19.325* reported by websites like cve.org, cvedetails.com, NVD  etc in their repository *linux-cip* (repo link:- https://gitlab.com/cip-project/cip-kernel/linux-cip.git ) in *linux-4.19.y-cip branch* ?
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[-- Attachment #2: Type: text/html, Size: 3473 bytes --]

Re: Urgent: Regarding Fixing of Security Vulnerabilities

[whyshall]

[-- Attachment #1: Type: text/plain, Size: 59 bytes --]

Hi Pavel Machek,

Your reply is awaited.

Thank you !

[-- Attachment #2: Type: text/html, Size: 113 bytes --]