The upstream kernel tree is the main Linux source code branch where new features and security fixes are merged first. In practice, it is the reference version for kernel development: once a patch lands upstream, downstream vendors and distributions can review it, backport it, and build supported releases from it.
This matters in cyber security because many vulnerability records are created from fixes already present upstream. A CVE may be announced even though the code is already corrected in the mainline tree, so defenders must check whether their exact kernel build includes the fix, whether it was backported, and whether the affected subsystem is actually in use. Attackers target kernels that lag behind upstream or miss vendor updates; defenders use the upstream tree as the authoritative source for patch status, code review, and regression testing.