--- x/net/bluetooth/hci_sync.c
+++ h/net/bluetooth/hci_sync.c
@@ -4803,6 +4803,7 @@ int hci_dev_close_sync(struct hci_dev *h
 			cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
 	}
 
+	cancel_delayed_work_sync(&hdev->cmd_timer);
 	/* Avoid potential lockdep warnings from the *_flush() calls by
 	 * ensuring the workqueue is empty up front.
 	 */