Hi,

Found a use-after-free in hci_uart_write_work when running Syzkaller on
Linux 6.19-rc5 (commit 0f61b18).

KASAN reports null-ptr-deref in the workqueue handler, looks like the
work wasn't cancelled before the structure got freed.

C reproducer and dmesg attached.

Thanks,
JiaHong Su