diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c0aa9f436998d42987e1a4dbc2ad8712f6518924..8dc1f0fbe9c13f1c7192aec68238c6bac5a181ef 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1614,29 +1614,24 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
 
 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
 {
-	struct hci_cp_le_create_conn *cp;
 	struct hci_conn *conn;
 
 	BT_DBG("%s status 0x%2.2x", hdev->name, status);
 
-	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
-	if (!cp)
-		return;
-
 	if (status) {
 		hci_dev_lock(hdev);
 
-		conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
+		conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 		if (!conn) {
 			hci_dev_unlock(hdev);
 			return;
 		}
 
-		BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
+		BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&conn->dst),
 		       conn);
 
 		conn->state = BT_CLOSED;
-		mgmt_connect_failed(hdev, &cp->peer_addr, conn->type,
+		mgmt_connect_failed(hdev, &conn->dst, conn->type,
 				    conn->dst_type, status);
 		hci_proto_connect_cfm(conn, status);
 		hci_conn_del(conn);