Unpatched Zephyr OS Expose Devices to DoS Attacks via IP Spoofing

Synopsys CyRC researchers disclosed flaws in the Zephyr OS network stack that allow externally received IP packets with spoofed source addresses (matching the host or destination) to be processed instead of dropped, enabling IP address spoofing that can bypass host IP-based access controls and cause loopback-triggered denial-of-service; affected Zephyr versions include 3.5, 3.4, and 2.7 (LTS), and patches have been merged into main and release branches.