diff --git a/openbsc/src/bsc_api.c b/openbsc/src/bsc_api.c
index 085a8c9..6c2f10d 100644
--- a/openbsc/src/bsc_api.c
+++ b/openbsc/src/bsc_api.c
@@ -382,6 +382,14 @@
 {
 	struct msgb *msg = _data;
 
+	/*
+	 * There seems to be a small window that the RLL timer can
+	 * fire after a lchan_release call and before the S_CHALLOC_FREED
+	 * is called. Check if a conn is set before proceeding.
+	 */
+	if (!lchan->conn)
+		return;
+
 	switch (rllr_ind) {
 	case BSC_RLLR_IND_EST_CONF:
 		rsl_data_request(msg, OBSC_LINKID_CB(msg));