--- x/net/bluetooth/mgmt.c +++ y/net/bluetooth/mgmt.c @@ -1472,7 +1472,8 @@ static void cmd_complete_rsp(struct mgmt /* dequeue cmd_sync entries using cmd as data as that is about to be * removed/freed. */ - hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL); + if (!hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL)) + return; if (cmd->cmd_complete) { cmd->cmd_complete(cmd, match->mgmt_status);