--- a/include/net/bluetooth/l2cap.h	2022-08-18 18:35:59.471364600 +0800
+++ b/include/net/bluetooth/l2cap.h	2022-08-18 18:41:09.480876900 +0800
@@ -628,6 +628,7 @@ struct l2cap_chan {
 	__u32		remote_acc_lat;
 	__u32		remote_flush_to;
 
+	int fully_init;
 	struct delayed_work	chan_timer;
 	struct delayed_work	retrans_timer;
 	struct delayed_work	monitor_timer;
--- a/net/bluetooth/l2cap_core.c	2022-08-19 18:57:55.891994000 +0800
+++ b/net/bluetooth/l2cap_core.c	2022-08-19 19:01:35.547512700 +0800
@@ -685,6 +685,8 @@ void l2cap_chan_del(struct l2cap_chan *c
 		break;
 
 	case L2CAP_MODE_ERTM:
+		if (!chan->fully_init)
+			break;
 		__clear_retrans_timer(chan);
 		__clear_monitor_timer(chan);
 		__clear_ack_timer(chan);
@@ -3326,6 +3328,7 @@ int l2cap_ertm_init(struct l2cap_chan *c
 	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
 
 	skb_queue_head_init(&chan->srej_q);
+	chan->fully_init = 1;
 
 	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
 	if (err < 0)