diff --git a/lib/kadm5/set_keys.c b/lib/kadm5/set_keys.c
index 751ab05d7..cf38f0ba5 100644
--- a/lib/kadm5/set_keys.c
+++ b/lib/kadm5/set_keys.c
@@ -405,6 +405,8 @@ out:
    if (n_keys && new_keys) {
        *new_keys     = kblock;
        *n_keys       = num_keys;
+   } else {
+        free(kblock);
    }
 
    hdb_entry_set_pw_change_time(context->context, ent, 0);