to which distros? how do you ensure fairness? Do you report this to the maintainer of Red Star OS (north korea)?

The kernel security team was given the heads up a month ago. At that point it is their decision.