thanks - that seems to be at least a workaround.
Our background: We need to build a (lightly) patched kernel (actually just some modules that SuSE forgot). As far as we know there is no mechanism to track the SLES12 kernel updates. With SLES11 you could just mirror the kernel srpm and script around from there.
With SLES12 there is currently no possibility of tracking, so for us it looks like we need to pin to kernel version once and skip all the security updates.
That sucks - for us and for our clients.
The really correct way would be for us to look at the kernel-x-Extras package. But though this package is mentioned in the SLES-docs and SLES 12 Release notes, it is nowhere to be found (the SRPM builds it though).