diff --git a/nimble/host/mesh/src/glue.c b/nimble/host/mesh/src/glue.c
index fadff0b66..7da73d15b 100644
--- a/nimble/host/mesh/src/glue.c
+++ b/nimble/host/mesh/src/glue.c
@@ -120,13 +120,16 @@ bt_encrypt_be(const uint8_t *key, const uint8_t *plaintext, uint8_t *enc_data)
     mbedtls_aes_init(&s);
 
     if (mbedtls_aes_setkey_enc(&s, key, 128) != 0) {
+        mbedtls_aes_free(&s);
         return BLE_HS_EUNKNOWN;
     }
 
     if (mbedtls_aes_crypt_ecb(&s, MBEDTLS_AES_ENCRYPT, plaintext, enc_data) != 0) {
+        mbedtls_aes_free(&s);
         return BLE_HS_EUNKNOWN;
     }
 
+    mbedtls_aes_free(&s);
     return 0;
 }
 
diff --git a/nimble/host/src/ble_sm_alg.c b/nimble/host/src/ble_sm_alg.c
index c39f5a6b2..ee8b937c5 100644
--- a/nimble/host/src/ble_sm_alg.c
+++ b/nimble/host/src/ble_sm_alg.c
@@ -88,14 +88,18 @@ ble_sm_alg_encrypt(const uint8_t *key, const uint8_t *plaintext,
 
     mbedtls_aes_init(&s);
     if (mbedtls_aes_setkey_enc(&s, tmp, 128) != 0) {
+        mbedtls_aes_free(&s);
         return BLE_HS_EUNKNOWN;
     }
 
     swap_buf(tmp, plaintext, 16);
 
     if (mbedtls_aes_crypt_ecb(&s, MBEDTLS_AES_ENCRYPT, tmp, enc_data) != 0) {
+        mbedtls_aes_free(&s);
         return BLE_HS_EUNKNOWN;
     }
+
+    mbedtls_aes_free(&s);
 #else
     struct tc_aes_key_sched_struct s;