Urgent: Regarding Fixing of Security Vulnerabilities

 Hi ,

We are planning to migrate our product to the Linux Kernel 4.19.y CIP
release to benefit from its long-term maintenance and security updates.

We have a few questions regarding security vulnerability tracking for the
CIP kernel:

   1. Is there any tool, dashboard, or documentation available to determine:
      - The Kernel CVEs applicable to a specific 4.19.y CIP release.
      - Which CVEs have already been fixed till the given CIP release.
      - Which CVEs are still outstanding.
      2. Is there a published roadmap or policy indicating how unresolved
   Kernel CVEs are evaluated and scheduled for backporting to the 4.19.y CIP
   branch?
   3. For CVEs that remain unfixed in the CIP kernel:
      - What are the expected implications or risks for users of the CIP
      release?
      - Are these vulnerabilities typically already addressed in the
      upstream mainline Linux kernel, with backporting to CIP pending due to
      compatibility or maintenance considerations?
      4. If there are unfixed vulnerabilities that are considered critical
   for our product, what is the recommended approach to address them?


   - Does the CIP project provide any guidance or best practices for
      evaluating, backporting, or mitigating such vulnerabilities?
      - If a required fix is available only in the upstream mainline
      kernel, are there any recommendations or guidelines for safely
backporting
      it to the CIP kernel?

Any guidance on the recommended process or tools for tracking the security
status of CIP kernel releases would be greatly appreciated.

Thank you for your support.