diff --git a/nimble/host/src/ble_l2cap.c b/nimble/host/src/ble_l2cap.c
index 584f44312..c79081eec 100644
--- a/nimble/host/src/ble_l2cap.c
+++ b/nimble/host/src/ble_l2cap.c
@@ -394,6 +394,7 @@ ble_l2cap_rx(uint16_t conn_handle, uint8_t pb, struct os_mbuf *om)
 
     if (!chan) {
         ble_l2cap_sig_reject_invalid_cid_tx(conn_handle, 0, 0, rx_cid);
+        os_mbuf_free_chain(rx_frags);
         return BLE_HS_ENOENT;
     }
 
@@ -406,11 +407,13 @@ ble_l2cap_rx(uint16_t conn_handle, uint8_t pb, struct os_mbuf *om)
     if (chan->dcid >= BLE_L2CAP_COC_CID_START &&
         chan->dcid <= BLE_L2CAP_COC_CID_END && rx_len > chan->my_coc_mps) {
         ble_l2cap_disconnect(chan);
+        os_mbuf_free_chain(rx_frags);
         return BLE_HS_EBADDATA;
     }
 
     if (rx_len > ble_l2cap_get_mtu(chan)) {
         ble_l2cap_disconnect(chan);
+        os_mbuf_free_chain(rx_frags);
         return BLE_HS_EBADDATA;
     }