diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 1cd05072dbb7c9273707377994d2d02e5cc53e1c..4debe205d4af35f1389c312e8f008ebcc11613ab 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -4721,6 +4721,7 @@ int hci_dev_open_sync(struct hci_dev *hdev)
 			hdev->flush(hdev);
 
 		if (hdev->sent_cmd) {
+			cancel_delayed_work_sync(&hdev->cmd_timer);
 			kfree_skb(hdev->sent_cmd);
 			hdev->sent_cmd = NULL;
 		}