--- x/net/bluetooth/l2cap_sock.c
+++ y/net/bluetooth/l2cap_sock.c
@@ -1532,7 +1532,9 @@ static void l2cap_sock_cleanup_listen(st
 		struct l2cap_chan *chan;
 
 		lock_sock_nested(sk, L2CAP_NESTING_NORMAL);
-		chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan);
+		chan = l2cap_pi(sk)->chan;
+		if (chan)
+			chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan);
 		release_sock(sk);
 		if (!chan) {
 			/* l2cap_conn_del() already tearing this child down */