diff --git a/src/responder/kcm/kcmsrv_ccache.c b/src/responder/kcm/kcmsrv_ccache.c
index 6e4ea64e01..4f4f8b46a4 100644
--- a/src/responder/kcm/kcmsrv_ccache.c
+++ b/src/responder/kcm/kcmsrv_ccache.c
@@ -404,7 +404,7 @@ krb5_creds **kcm_cc_unmarshal(TALLOC_CTX *mem_ctx,
 
     tmp_ctx = talloc_new(NULL);
     if (tmp_ctx == NULL) {
-        goto done;
+        goto fail;
     }
 
     for (cred = kcm_cc_get_cred(cc); cred != NULL; cred = kcm_cc_next_cred(cred)) {
@@ -417,7 +417,7 @@ krb5_creds **kcm_cc_unmarshal(TALLOC_CTX *mem_ctx,
         cred_list[i] = kcm_cred_to_krb5(krb_context, cred);
         if (cred_list[i] == NULL) {
             DEBUG(SSSDBG_CRIT_FAILURE, "Failed to convert kcm cred to krb5\n");
-            goto done;
+            goto fail;
         }
     }
 
@@ -426,8 +426,10 @@ krb5_creds **kcm_cc_unmarshal(TALLOC_CTX *mem_ctx,
 
     talloc_steal(mem_ctx, cred_list);
 
+    talloc_free(tmp_ctx);
     return cred_list;
-done:
+
+fail:
     talloc_free(tmp_ctx);
     return NULL;
 #endif