diff --git a/package/esp-hosted/esp-hosted-0001-fix-unload-crash.patch b/package/esp-hosted/esp-hosted-0001-fix-unload-crash.patch
new file mode 100644
index 0000000000..15e0560e01
--- /dev/null
+++ b/package/esp-hosted/esp-hosted-0001-fix-unload-crash.patch
@@ -0,0 +1,31 @@
+diff --git a/esp_hosted_ng/host/esp_bt.c b/esp_hosted_ng/host/esp_bt.c
+index 3b78c116..7f08c8d0 100644
+--- a/esp_hosted_ng/host/esp_bt.c
++++ b/esp_hosted_ng/host/esp_bt.c
+@@ -173,6 +173,7 @@ int esp_deinit_bt(struct esp_adapter *adapter)
+ 
+ 	hdev = adapter->hcidev;
+ 
++	hci_set_drvdata(hdev, NULL);
+ 	hci_unregister_dev(hdev);
+ 	hci_free_dev(hdev);
+ 
+@@ -227,6 +228,9 @@ int esp_init_bt(struct esp_adapter *adapter)
+ 		return -EINVAL;
+ 	}
+ 
++	if (adapter->dev)
++		SET_HCIDEV_DEV(hdev, adapter->dev);
++
+ 	hdev->open  = esp_bt_open;
+ 	hdev->close = esp_bt_close;
+ 	hdev->flush = esp_bt_flush;
+@@ -242,8 +246,6 @@ int esp_init_bt(struct esp_adapter *adapter)
+ 
+ 	hdev->dev_type = HCI_PRIMARY;
+ 
+-	SET_HCIDEV_DEV(hdev, adapter->dev);
+-
+ 	ret = hci_register_dev(hdev);
+ 	if (ret < 0) {
+ 		BT_ERR("Can not register HCI device");
diff --git a/package/esp-hosted/esp-hosted-0002-fix-flush-cmd-workqueue.patch b/package/esp-hosted/esp-hosted-0002-fix-flush-cmd-workqueue.patch
new file mode 100644
index 0000000000..81f01ab8cd
--- /dev/null
+++ b/package/esp-hosted/esp-hosted-0002-fix-flush-cmd-workqueue.patch
@@ -0,0 +1,13 @@
+diff --git a/esp_hosted_ng/host/esp_cmd.c b/esp_hosted_ng/host/esp_cmd.c
+index 4b8bab3d..ec5f7c23 100644
+--- a/esp_hosted_ng/host/esp_cmd.c
++++ b/esp_hosted_ng/host/esp_cmd.c
+@@ -452,7 +452,7 @@ static int create_cmd_wq(struct esp_adapter *adapter)
+ static void destroy_cmd_wq(struct esp_adapter *adapter)
+ {
+ 	if (adapter->cmd_wq) {
+-		flush_scheduled_work();
++		cancel_work_sync(&adapter->cmd_work);
+ 		destroy_workqueue(adapter->cmd_wq);
+ 		adapter->cmd_wq = NULL;
+ 	}