diff --git a/daemons/ipa-kdb/ipa_kdb_passwords.c b/daemons/ipa-kdb/ipa_kdb_passwords.c
index 93e9e2060..0bb7fa724 100644
--- a/daemons/ipa-kdb/ipa_kdb_passwords.c
+++ b/daemons/ipa-kdb/ipa_kdb_passwords.c
@@ -203,6 +203,7 @@ krb5_error_code ipadb_change_pwd(krb5_context context,
             ret = asprintf(&ied->pw_policy_dn,
                            "cn=global_policy,%s", ipactx->realm_base);
             if (ret == -1) {
+                free(ied);
                 return ENOMEM;
             }
             db_entry->e_data = (krb5_octet *)ied;