--- a/include/net/bluetooth/l2cap.h	2022-08-18 18:35:59.471364600 +0800
+++ b/include/net/bluetooth/l2cap.h	2022-08-18 18:41:09.480876900 +0800
@@ -628,6 +628,7 @@ struct l2cap_chan {
 	__u32		remote_acc_lat;
 	__u32		remote_flush_to;
 
+	int fully_init;
 	struct delayed_work	chan_timer;
 	struct delayed_work	retrans_timer;
 	struct delayed_work	monitor_timer;
--- a/net/bluetooth/l2cap_core.c	2022-08-18 18:32:42.611689700 +0800
+++ b/net/bluetooth/l2cap_core.c	2022-08-18 18:43:04.622922500 +0800
@@ -685,6 +685,8 @@ void l2cap_chan_del(struct l2cap_chan *c
 		break;
 
 	case L2CAP_MODE_ERTM:
+		if (!chan->fully_init)
+			break;
 		__clear_retrans_timer(chan);
 		__clear_monitor_timer(chan);
 		__clear_ack_timer(chan);
@@ -3317,6 +3319,7 @@ int l2cap_ertm_init(struct l2cap_chan *c
 	if (chan->mode != L2CAP_MODE_ERTM)
 		return 0;
 
+	chan->fully_init = 1;
 	chan->rx_state = L2CAP_RX_STATE_RECV;
 	chan->tx_state = L2CAP_TX_STATE_XMIT;