--- x/net/bluetooth/sco.c
+++ y/net/bluetooth/sco.c
@@ -445,6 +445,11 @@ static void sco_sock_close(struct sock *
 	sco_sock_clear_timer(sk);
 	__sco_sock_close(sk);
 	release_sock(sk);
+
+	if (sco_pi(sk)->conn) {
+		/* sock zapped without calling sco_chan_del() */
+		cancel_delayed_work_sync(&sco_pi(sk)->conn->timeout_work);
+	}
 }
 
 static void sco_skb_put_cmsg(struct sk_buff *skb, struct msghdr *msg,