--- y/net/bluetooth/hci_core.c
+++ x/net/bluetooth/hci_core.c
@@ -2675,6 +2675,7 @@ void hci_unregister_dev(struct hci_dev *
 	list_del(&hdev->list);
 	write_unlock(&hci_dev_list_lock);
 
+	cancel_work_sync(&hdev->power_on);
 	hci_cmd_sync_clear(hdev);
 
 	if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks))
--- y/net/bluetooth/hci_sync.c
+++ x/net/bluetooth/hci_sync.c
@@ -2675,6 +2675,7 @@ void hci_unregister_dev(struct hci_dev *
 	list_del(&hdev->list);
 	write_unlock(&hci_dev_list_lock);
 
+	cancel_work_sync(&hdev->power_on);
 	hci_cmd_sync_clear(hdev);
 
 	if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks))