kernel: add a locking fix for netfilter hardware flow offloading