diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 3066f56..83fc92e 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1032,6 +1032,7 @@
 	ret = datablob_parse(datablob, new_p, new_o);
 	if (ret != Opt_update) {
 		ret = -EINVAL;
+		kfree(new_p);
 		goto out;
 	}
 	/* copy old key values, and reseal with new pcrs */