Local privilege escalation via failed filter replacement

Use-after-free in Linux kernel cls_u32 allows local users to gain kernel privileges through rtnetlink filter changes. When u32_replace_hw_knode fails, u32_set_parms leaves tcf_bind_filter's reference and class accounting in place, creating a dangling res.class pointer that htb_classify later dereferences. An unprivileged local user can obtain CAP_NET_ADMIN in a user namespace, force the failure with skip_sw on a non-offload device, and then achieve kernel code execution or a crash.