diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index a3b15b4e176e..4c81883ba25e 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -82,6 +82,10 @@ static void sco_sock_timeout(struct work_struct *work)
 	struct sock *sk;
 
 	sco_conn_lock(conn);
+	if (!conn->hcon) {
+		sco_conn_unlock(conn);
+		return;
+	}
 	sk = conn->sk;
 	if (sk)
 		sock_hold(sk);