## This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues: The following security issues were fixed: * CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370). * CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283). * CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391). * CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837). * CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015). * CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012). * CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).

* bsc#1267370

* bsc#1272208

* bsc#1272283

* bsc#1272391

* bsc#1272679

* bsc#1272837

* bsc#1273003

* bsc#1273011

* bsc#1273012

* bsc#1273015

* bsc#1273051

* bsc#1273052

* bsc#1273833

* bsc#1273837

* bsc#1275162

* bsc#1275228

* bsc#1276299

* bsc#1276493

* bsc#1277409

* bsc#1277506

Cross-

* CVE-2026-46116

* CVE-2026-63802

* CVE-2026-63888

* CVE-2026-63912

* CVE-2026-63917

* CVE-2026-63920

* CVE-2026-63921

* CVE-2026-63944

* CVE-2026-63971

* CVE-2026-63994

* CVE-2026-64000

* CVE-2026-64011

* CVE-2026-64114

* CVE-2026-64121

* CVE-2026-64189

* CVE-2026-68121

* CVE-2026-68202

* CVE-2026-72217

* CVE-2026-74394

* CVE-2026-74612

CVSS scores:

* CVE-2026-46116 ( SUSE ): 8.5

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N