diff --git a/components/bt/esp_ble_mesh/mesh_core/bluedroid_host/mesh_bearer_adapt.c b/components/bt/esp_ble_mesh/mesh_core/bluedroid_host/mesh_bearer_adapt.c
index b3745c1a3f..49a0ee6fa5 100644
--- a/components/bt/esp_ble_mesh/mesh_core/bluedroid_host/mesh_bearer_adapt.c
+++ b/components/bt/esp_ble_mesh/mesh_core/bluedroid_host/mesh_bearer_adapt.c
@@ -1883,6 +1883,7 @@ int bt_mesh_encrypt_le(const uint8_t key[16], const uint8_t plaintext[16],
     sys_memcpy_swap(tmp, key, 16);
 
     if (mbedtls_aes_setkey_enc(&ctx, tmp, 128) != 0) {
+        mbedtls_aes_free(&ctx);
         return -EINVAL;
     }
 
@@ -1890,8 +1891,11 @@ int bt_mesh_encrypt_le(const uint8_t key[16], const uint8_t plaintext[16],
 
     if (mbedtls_aes_crypt_ecb(&ctx, MBEDTLS_AES_ENCRYPT,
                               tmp, enc_data) != 0) {
+        mbedtls_aes_free(&ctx);
         return -EINVAL;
     }
+
+    mbedtls_aes_free(&ctx);
 #else /* CONFIG_MBEDTLS_HARDWARE_AES */
     struct tc_aes_key_sched_struct s = {0};
 
@@ -1926,13 +1930,17 @@ int bt_mesh_encrypt_be(const uint8_t key[16], const uint8_t plaintext[16],
     mbedtls_aes_init(&ctx);
 
     if (mbedtls_aes_setkey_enc(&ctx, key, 128) != 0) {
+        mbedtls_aes_free(&ctx);
         return -EINVAL;
     }
 
     if (mbedtls_aes_crypt_ecb(&ctx, MBEDTLS_AES_ENCRYPT,
                               plaintext, enc_data) != 0) {
+        mbedtls_aes_free(&ctx);
         return -EINVAL;
     }
+
+    mbedtls_aes_free(&ctx);
 #else /* CONFIG_MBEDTLS_HARDWARE_AES */
     struct tc_aes_key_sched_struct s = {0};
 
diff --git a/components/bt/esp_ble_mesh/mesh_core/nimble_host/mesh_bearer_adapt.c b/components/bt/esp_ble_mesh/mesh_core/nimble_host/mesh_bearer_adapt.c
index 25bcdb8356..2b0a5d3933 100644
--- a/components/bt/esp_ble_mesh/mesh_core/nimble_host/mesh_bearer_adapt.c
+++ b/components/bt/esp_ble_mesh/mesh_core/nimble_host/mesh_bearer_adapt.c
@@ -1864,6 +1864,7 @@ int bt_mesh_encrypt_le(const uint8_t key[16], const uint8_t plaintext[16],
     sys_memcpy_swap(tmp, key, 16);
 
     if (mbedtls_aes_setkey_enc(&ctx, tmp, 128) != 0) {
+        mbedtls_aes_free(&ctx);
         return -EINVAL;
     }
 
@@ -1871,8 +1872,11 @@ int bt_mesh_encrypt_le(const uint8_t key[16], const uint8_t plaintext[16],
 
     if (mbedtls_aes_crypt_ecb(&ctx, MBEDTLS_AES_ENCRYPT,
                               tmp, enc_data) != 0) {
+        mbedtls_aes_free(&ctx);
         return -EINVAL;
     }
+
+    mbedtls_aes_free(&ctx);
 #else /* CONFIG_MBEDTLS_HARDWARE_AES */
     struct tc_aes_key_sched_struct s = {0};
 
@@ -1907,13 +1911,17 @@ int bt_mesh_encrypt_be(const uint8_t key[16], const uint8_t plaintext[16],
     mbedtls_aes_init(&ctx);
 
     if (mbedtls_aes_setkey_enc(&ctx, key, 128) != 0) {
+        mbedtls_aes_free(&ctx);
         return -EINVAL;
     }
 
     if (mbedtls_aes_crypt_ecb(&ctx, MBEDTLS_AES_ENCRYPT,
                               plaintext, enc_data) != 0) {
+        mbedtls_aes_free(&ctx);
         return -EINVAL;
     }
+
+    mbedtls_aes_free(&ctx);
 #else /* CONFIG_MBEDTLS_HARDWARE_AES */
     struct tc_aes_key_sched_struct s = {0};