diff --git a/src/frame-xchg.c b/src/frame-xchg.c
index d26e0c54..0e3e330d 100644
--- a/src/frame-xchg.c
+++ b/src/frame-xchg.c
@@ -116,6 +116,7 @@ struct frame_xchg_data {
 	unsigned int retries_on_ack;
 	struct wiphy_radio_work_item work;
 	bool no_cck_rates;
+	unsigned int tx_cmd_id;
 };
 
 struct frame_xchg_watch_data {
@@ -772,6 +773,9 @@ static void frame_xchg_reset(struct frame_xchg_data *fx)
 	if (fx->timeout)
 		l_timeout_remove(fx->timeout);
 
+	if (fx->tx_cmd_id)
+		l_genl_family_cancel(nl80211, fx->tx_cmd_id);
+
 	l_free(fx->early_frame.mpdu);
 	fx->early_frame.mpdu = NULL;
 	l_queue_destroy(fx->rx_watches, l_free);
@@ -930,12 +934,18 @@ error:
 	frame_xchg_done(fx, error);
 }
 
+static void frame_xchg_tx_destroy(void *user_data)
+{
+	struct frame_xchg_data *fx = user_data;
+
+	fx->tx_cmd_id = 0;
+}
+
 static bool frame_xchg_tx_retry(struct wiphy_radio_work_item *item)
 {
 	struct frame_xchg_data *fx = l_container_of(item,
 						struct frame_xchg_data, work);
 	struct l_genl_msg *msg;
-	uint32_t cmd_id;
 	uint32_t duration = fx->resp_timeout;
 
 	/*
@@ -963,8 +973,9 @@ static bool frame_xchg_tx_retry(struct wiphy_radio_work_item *item)
 		l_genl_msg_append_attr(msg, NL80211_ATTR_DURATION, 4,
 					&duration);
 
-	cmd_id = l_genl_family_send(nl80211, msg, frame_xchg_tx_cb, fx, NULL);
-	if (!cmd_id) {
+	fx->tx_cmd_id = l_genl_family_send(nl80211, msg, frame_xchg_tx_cb, fx,
+						frame_xchg_tx_destroy);
+	if (!fx->tx_cmd_id) {
 		l_error("Error sending frame");
 		l_genl_msg_unref(msg);
 		frame_xchg_done(fx, -EIO);