diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b705cb360c9066c4e5a916db56cd0f14c073b647..c084533fedaf9dd63c5ccc1dcaaa92fccb277be1 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -426,6 +426,9 @@ static void l2cap_chan_timeout(struct work_struct *work)
 
 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 
+	if (!conn)
+		return;
+
 	mutex_lock(&conn->chan_lock);
 	l2cap_chan_lock(chan);