diff --git a/crypto/authencesn.c b/crypto/authencesn.c
index 15f91ddd7f0e4e55cfba21b3da4505532e85cac3..50b804747e20a3a9a68e158bab1e900949b75b27 100644
--- a/crypto/authencesn.c
+++ b/crypto/authencesn.c
@@ -90,6 +90,7 @@ static int crypto_authenc_esn_setkey(struct crypto_aead *authenc_esn, const u8 *
 					   CRYPTO_TFM_RES_MASK);
 
 out:
+	memzero_explicit(&keys, sizeof(keys));
 	return err;
 
 badkey: