--- y/net/sched/cls_route.c
+++ c/net/sched/cls_route.c
@@ -476,6 +476,7 @@ static int route4_change(struct net *net
 	unsigned int h, th;
 	int err;
 	bool new = true;
+	struct route4_filter *victim = NULL;
 
 	if (opt == NULL)
 		return handle ? -EINVAL : 0;
@@ -536,6 +537,7 @@ static int route4_change(struct net *net
 			     fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
 				if (pfp == fold) {
 					rcu_assign_pointer(*fp, fold->next);
+					victim = fold;
 					break;
 				}
 			}
@@ -544,7 +546,8 @@ static int route4_change(struct net *net
 
 	route4_reset_fastmap(head);
 	*arg = f;
-	if (fold) {
+	if (victim) {
+		fold = victim;
 		tcf_unbind_filter(tp, &fold->res);
 		tcf_exts_get_net(&fold->exts);
 		tcf_queue_work(&fold->rwork, route4_delete_filter_work);