## This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.37.1 fixes various security issues: The following security issues were fixed: * CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391). * CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015). * CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012). * CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011). * CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052). * CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833). * CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).

* bsc#1272391

* bsc#1273011

* bsc#1273012

* bsc#1273015

* bsc#1273052

* bsc#1273833

* bsc#1273837

* bsc#1275228

* bsc#1276299

* bsc#1277409

* bsc#1277506

Cross-

* CVE-2026-63888

* CVE-2026-63917

* CVE-2026-63920

* CVE-2026-63921

* CVE-2026-64000

* CVE-2026-64114

* CVE-2026-64121

* CVE-2026-68121

* CVE-2026-72217

* CVE-2026-74394

* CVE-2026-74612

CVSS scores:

* CVE-2026-63888 ( SUSE ): 6.1

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

* CVE-2026-63888 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

* CVE-2026-63888 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-63917 ( SUSE ): 8.5

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

* CVE-2026-63917 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H