diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index aca71c087a1dbe893ab24b19087b7ccf4856a667..b074bd698cf6c3fae6044992fa8c9fff5ed13199 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -795,11 +795,11 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 void hci_conn_hash_flush(struct hci_dev *hdev)
 {
 	struct hci_conn_hash *h = &hdev->conn_hash;
-	struct hci_conn *c;
+	struct hci_conn *c, *n;
 
 	BT_DBG("hdev %s", hdev->name);
 
-	list_for_each_entry_rcu(c, &h->list, list) {
+	list_for_each_entry_safe(c, n, &h->list, list) {
 		c->state = BT_CLOSED;
 
 		hci_proto_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);