diff --git a/ChangeLog.d/rsa-mutex.txt b/ChangeLog.d/rsa-mutex.txt
new file mode 100644
index 000000000..bafb7b2d5
--- /dev/null
+++ b/ChangeLog.d/rsa-mutex.txt
@@ -0,0 +1,8 @@
+Bugfix
+   * Ensure that calling mbedtls_rsa_free() twice is safe. This happens
+     when some Mbed TLS library functions fail. Such a double-free was
+     not safe when MBEDTLS_THREADING_C was enabled on platforms where
+     freeing a mutex twice is not safe.
+   * Fix a resource leak in a bad-arguments case of mbedtls_rsa_gen_key()
+     when MBEDTLS_THREADING_C is enabled on platforms where initializing
+     a mutex allocates resources.