--- x/net/bluetooth/hci_conn.c
+++ y/net/bluetooth/hci_conn.c
@@ -1151,6 +1151,7 @@ static struct hci_conn *__hci_conn_add(s
 	}
 
 	hci_conn_init_sysfs(conn);
+	hci_conn_get(conn);
 	return conn;
 }
 
@@ -1316,6 +1317,7 @@ void hci_conn_del(struct hci_conn *conn)
 	 * rest of hci_conn_del.
 	 */
 	hci_conn_cleanup(conn);
+	hci_conn_put(conn);
 
 	/* Dequeue callbacks using connection pointer as data */
 	hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);