Urgent: Regarding Fixing of Security Vulnerabilities
[email protected] Thu, 09 Jul 2026 02:13:04 -0700
| Newsgroups | org.cip-project.lists.cip-dev |
|---|---|
| Message-ID | <20260709091304.RS-HV9xRMukFV0v02e2SEqvWAR9RA_yC-Dq8jV7WmaI@z> |
Hi , We are planning to migrate our product to the Linux Kernel 4.19.y CIP release to benefit from its long-term maintenance and security updates. We have a few questions regarding security vulnerability tracking for the CIP kernel: * Is there any tool, dashboard, or documentation available to determine: * The Kernel CVEs applicable to a specific 4.19.y CIP release. * Which CVEs have already been fixed till the given CIP release. * Which CVEs are still outstanding. * Is there a published roadmap or policy indicating how unresolved Kernel CVEs are evaluated and scheduled for backporting to the 4.19.y CIP branch? * For CVEs that remain unfixed in the CIP kernel: * What are the expected implications or risks for users of the CIP release? * Are these vulnerabilities typically already addressed in the upstream mainline Linux kernel, with backporting to CIP pending due to compatibility or maintenance considerations? * If there are unfixed vulnerabilities that are considered critical for our product, what is the recommended approach to address them? * Does the CIP project provide any guidance or best practices for evaluating, backporting, or mitigating such vulnerabilities? * If a required fix is available only in the upstream mainline kernel, are there any recommendations or guidelines for safely backporting it to the CIP kernel? Any guidance on the recommended process or tools for tracking the security status of CIP kernel releases would be greatly appreciated. Also, we came across an opensource tool called *kernel-backport-checker* , which identifies *Linux kernel CVEs* that have been addressed through backported commits in a Git repository, filtered based on the kernel configuration. We executed this tool against the latest CIP release, cip-4.19.325-cip134. The output generated by the tool is provided below: ./kernel-backport-checker.sh \ > -s ../../linux-cip-4.19.325- cip134 \ > -d ../linux \ > -b ../linux-stable \ > -e ../kev-data \ > -f ../nvd-json-data-feeds \ > -k ../../linux-cip-4.19.325- cip134/.config \ > -o ../../linux-cip-4.19.325- cip134/cve_report -j 4 ============================== ========== Kernel Backport Checker v3.2.0 ============================== ========== [INFO] Configuration: [INFO] Kernel Source: ../../linux-cip-4.19.325- cip134 [INFO] Kernel Config: ../../linux-cip-4.19.325- cip134/.config [INFO] Git Repository: ../linux [INFO] Stable/Vendor: ../linux-stable [INFO] KEV File: ../kev-data/known_exploited_ vulnerabilities.json [INFO] NVD Feeds: ../nvd-json-data-feeds [INFO] Output: ../../linux-cip-4.19.325- cip134/cve_report [INFO] Parallel Jobs: 4 [INFO] Detecting kernel version... [INFO] Kernel version: 4.19.325 [INFO] Loading kernel config: ../../linux-cip-4.19.325- cip134/.config [INFO] Loaded 1752 enabled CONFIG options [INFO] Building CONFIG mapping from kernel Makefiles... [INFO] Built CONFIG mapping: 16301 file mappings, 1503 directory mappings [INFO] Scanning NVD feeds for CVEs affecting Linux kernel 4.19.325... [INFO] Phase 1: Finding kernel CVE files... [INFO] Found 18117 CVE files with Linux kernel CPEs [INFO] Phase 2: Extracting version ranges (sequential to ensure accuracy)... [INFO] Extracted 155638 version entries [INFO] Phase 3: Filtering for version 4.19.325... [INFO] NVD scan complete: 3600 CVEs affect kernel 4.19.325 [INFO] Extracting upstream fix commit hashes from NVD references (jobs=4)... [INFO] Extracted 17487 fix commit refs for 3410 CVEs [INFO] Building git hash index... [INFO] Git hash index built: 1967640 commits [INFO] Extracting backported CVE fixes from git... [INFO] Searching stable/vendor repo for CVE mentions: ../linux-stable [INFO] Found 4388 commit-CVE pairs (733 unique CVEs in git) [INFO] Building CISA KEV index... [INFO] KEV index built: 1631 CVEs [INFO] Processing results... [INFO] Matching fix commits against git repos... [INFO] Found 17469 fix commits in git repos [INFO] Extracting changed files and diffs from fix commits (jobs=4)... [INFO] Exporting lookup tables for parallel processing... [INFO] Processing 3600 affected CVEs (jobs=4)... [INFO] Processing complete. [INFO] Generating CSV report... [INFO] ============================== ============= [INFO] Report: ../../linux-cip-4.19.325- cip134/cve_report/backport- report.csv [INFO] ============================== ============= [INFO] [INFO] Summary for kernel 4.19.325: [INFO] Total CVEs: 3600 [INFO] Not applicable: 1718 [INFO] Applicable: 1882 [INFO] Fixed via backport: 73 [INFO] Likely fixed (review): 32 [INFO] Unfixed (remaining): 745 [INFO] Inconclusive: 1032 [INFO] [INFO] CVEs in CISA KEV: 6 (fixed: 1) [INFO] [INFO] Severity (applicable / unfixed): [INFO] CRITICAL: 21 / 5 [INFO] HIGH: 512 / 194 [INFO] MEDIUM: 1327 / 538 [INFO] LOW: 22 / 8 [INFO] Done! Why is this tool giving *Inconclusive* ?Will these ever be counted as vulnerabilities or not? Also, the number of *unfixed CVEs* as per this tool are 745. This tool also generates the list of those unfixed CVEs in a .csv file. Will these vulnerabilities *be resolved by CIP* in the next release or will it *take multiple releases* and hence more time to get solved? That is why I had asked whether CIP maintains a list of solved and unsolved vulnerabilities till date for 4.19.y-cip kernel ! We would appreciate your feedback on these results as well.