--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1800,11 +1800,18 @@ static void l2cap_info_timeout(struct wo
 {
 	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
 					       info_timer.work);
+	struct hci_dev *hdev = conn->hcon->hdev;
 
+	hci_dev_lock(hdev);
+	if (conn->hcon->state == BT_CLOSED) {
+		hci_dev_unlock(hdev);
+		return;
+	}
 	conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
 	conn->info_ident = 0;
 
 	l2cap_conn_start(conn);
+	hci_dev_unlock(hdev);
 }
 
 /*