network backend may cause Linux netfront to use freed SKBs

ISSUE DESCRIPTION

While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed.

IMPACT

A misbehaving or malicious backend may cause a Denial of Service (DoS) in the guest. Information leaks or privilege escalation cannot be ruled out.

VULNERABLE SYSTEMS

Linux versions 5.9 - 5.18 are vulnerable. Linux versions 5.8 and earlier are not vulnerable.
This vulnerability only increases the capability of an attacker in systems with less than fully privileged network backends (e.g. network driver domains). For systems where netback runs in dom0 (the default configuration), this vulnerability does not increase the capabilities of an attacker.