diff --git a/nimble/host/mesh/src/glue.c b/nimble/host/mesh/src/glue.c
index 3b765ee65..388c30165 100644
--- a/nimble/host/mesh/src/glue.c
+++ b/nimble/host/mesh/src/glue.c
@@ -133,13 +133,16 @@ bt_encrypt_be(const uint8_t *key, const uint8_t *plaintext, uint8_t *enc_data)
     mbedtls_aes_init(&s);
 
     if (mbedtls_aes_setkey_enc(&s, key, 128) != 0) {
+        mbedtls_aes_free(&s);
         return BLE_HS_EUNKNOWN;
     }
 
     if (mbedtls_aes_crypt_ecb(&s, MBEDTLS_AES_ENCRYPT, plaintext, enc_data) != 0) {
+        mbedtls_aes_free(&s);
         return BLE_HS_EUNKNOWN;
     }
 
+    mbedtls_aes_free(&s);
     return 0;
 }
 
diff --git a/nimble/host/src/ble_sm_alg.c b/nimble/host/src/ble_sm_alg.c
index 93453c603..627191e79 100644
--- a/nimble/host/src/ble_sm_alg.c
+++ b/nimble/host/src/ble_sm_alg.c
@@ -87,14 +87,18 @@ ble_sm_alg_encrypt(uint8_t *key, uint8_t *plaintext, uint8_t *enc_data)
 
     mbedtls_aes_init(&s);
     if (mbedtls_aes_setkey_enc(&s, tmp, 128) != 0) {
+        mbedtls_aes_free(&s);
         return BLE_HS_EUNKNOWN;
     }
 
     swap_buf(tmp, plaintext, 16);
 
     if (mbedtls_aes_crypt_ecb(&s, MBEDTLS_AES_ENCRYPT, tmp, enc_data) != 0) {
+        mbedtls_aes_free(&s);
         return BLE_HS_EUNKNOWN;
     }
+
+    mbedtls_aes_free(&s);
 #else
     struct tc_aes_key_sched_struct s;