Syzkaller reports use-after-free in hci_cmd_timeout(). The bug was fixed in the following patch and can be cleanly applied to 6.1 stable tree. Due to some technical rearrangement, the fix for older stable branches requires a different patch which I'll send you in another thread.