--- l/net/bluetooth/hci_request.c
+++ y/net/bluetooth/hci_request.c
@@ -181,7 +181,6 @@ int __hci_req_sync(struct hci_dev *hdev,
 		break;
 	}
 
-	kfree_skb(hdev->req_skb);
 	hdev->req_skb = NULL;
 	hdev->req_status = hdev->req_result = 0;