uname -r reports the actual running kernel. Uname is unaware of the runtime patches from kgraft. So fully correct is:

running kernel: <uname -r output> + <output kgr patches>

https://en.wikipedia.org/wiki/KGraft

Also does kGraft only address the security bugs i.e only receives the security updates ? or non-security updates too ?
https://documentation.suse.com/sles/...scope-patching