diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c
index 47e2b47f5f23..c1ddf33be9fb 100644
--- a/core/sme/src/csr/csr_api_roam.c
+++ b/core/sme/src/csr/csr_api_roam.c
@@ -1567,11 +1567,26 @@ void csr_release_command_roam(struct mac_context *mac, tSmeCmd *pCommand)
 }
 
 void csr_release_command_wm_status_change(struct mac_context *mac,
-					tSmeCmd *pCommand)
+					  tSmeCmd *pCommand)
 {
 	csr_reinit_wm_status_change_cmd(mac, pCommand);
 }
 
+static void csr_release_command_set_hw_mode(struct mac_context *mac,
+					    tSmeCmd *cmd)
+{
+	struct csr_roam_session *session;
+	uint32_t session_id;
+
+	if (cmd->u.set_hw_mode_cmd.reason ==
+	    POLICY_MGR_UPDATE_REASON_HIDDEN_STA) {
+		session_id = cmd->u.set_hw_mode_cmd.session_id;
+		session = CSR_GET_SESSION(mac, session_id);
+		if (session)
+			csr_saved_scan_cmd_free_fields(mac, session);
+	}
+}
+
 void csr_roam_substate_change(struct mac_context *mac,
 		enum csr_roam_substate NewSubstate, uint32_t sessionId)
 {
@@ -19209,6 +19224,8 @@ static void csr_free_cmd_memory(struct mac_context *mac, tSmeCmd *pCommand)
 	case eSmeCommandWmStatusChange:
 		csr_release_command_wm_status_change(mac, pCommand);
 		break;
+	case e_sme_command_set_hw_mode:
+		csr_release_command_set_hw_mode(mac, pCommand);
 	default:
 		break;
 	}
diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c
index 24d4ae52350e..caba80333fa4 100644
--- a/core/sme/src/csr/csr_api_scan.c
+++ b/core/sme/src/csr/csr_api_scan.c
@@ -1122,6 +1122,7 @@ void csr_saved_scan_cmd_free_fields(struct mac_context *mac_ctx,
 				    struct csr_roam_session *session)
 {
 	if (session->scan_info.profile) {
+		sme_debug("Free profile for session %d", session->sessionId);
 		csr_release_profile(mac_ctx,
 				    session->scan_info.profile);
 		qdf_mem_free(session->scan_info.profile);
@@ -1212,6 +1213,7 @@ static void csr_handle_nxt_cmd(struct mac_context *mac_ctx,
 			       uint8_t chan)
 {
 	QDF_STATUS status, ret;
+	struct csr_roam_session *session;
 
 	switch (nxt_cmd) {
 
@@ -1232,7 +1234,7 @@ static void csr_handle_nxt_cmd(struct mac_context *mac_ctx,
 		if (!QDF_IS_STATUS_SUCCESS(status)) {
 			/* csr_save_profile should report error */
 			sme_err("profile save failed %d", status);
-			return;
+			break;
 		}
 
 		if (QDF_STATUS_E_FAILURE == ret) {
@@ -1247,10 +1249,14 @@ static void csr_handle_nxt_cmd(struct mac_context *mac_ctx,
 		/* Else: Set hw mode was issued and the saved connect would
 		 * be issued after set hw mode response
 		 */
-		break;
+		if (QDF_IS_STATUS_SUCCESS(status))
+			return;
 	default:
 		break;
 	}
+	session = CSR_GET_SESSION(mac_ctx, session_id);
+	if (session)
+		csr_saved_scan_cmd_free_fields(mac_ctx, session);
 }
 
 void csr_scan_callback(struct wlan_objmgr_vdev *vdev,
@@ -1300,14 +1306,6 @@ void csr_scan_callback(struct wlan_objmgr_vdev *vdev,
 	/* We reuse the command here instead reissue a new command */
 	csr_handle_nxt_cmd(mac_ctx, NextCommand,
 			   session_id, chan);
-
-	if (session->scan_info.profile != NULL) {
-		sme_debug("Free the profile scan_id %d", event->scan_id);
-		csr_release_profile(mac_ctx, session->scan_info.profile);
-		qdf_mem_free(session->scan_info.profile);
-		session->scan_info.profile = NULL;
-	}
-
 }
 
 tCsrScanResultInfo *csr_scan_result_get_first(struct mac_context *mac,