There is no setting to automatically expire refresh tokens when the user changes their password. Here are some ideas that may help you solve your problem:
Use an Implicit Flow Instead
If you are developing a mobile app, it might be better to skip refresh tokens altogether, and use an implicit flow instead. This works best if the user is "online" and active any time your app connects to the Salesforce API.
For comparison, in general there are two different OAuth 2.0 flows apps can use:
In the implicit flow, the app redirects the user to Salesforce, the user logs in to Salesforce, and the app receives a short-lived access token. The user needs to log in every time the access token expires.
In the webserver flow, the app redirects the user to Salesforce, the user logs in to Salesforce, the app receives a temporary code, and the app sends the code to the Salesforce servers to get back a token. In this flow, the token can be a long-lived refresh token. The refresh token can be exchanged repeatedly for an access token, while the user does not need to log in again.
Set a Refresh Token Expiration Policy
While you can't expire refresh tokens on password change, you can expire refresh tokens after a configurable amount of time using a Refresh Token Policy for your connected app under Manage Apps > Connected Apps > Edit.

Write a Script
You could program your own periodic check of User.LastPasswordChangeDate
, which together with OauthToken.DeleteToken
would allow you to revoke a refresh token programatically. You would call https://login.salesforce.com/services/oauth2/revoke?token={DeleteToken}
to trigger the revocation. Note that depending on how your connected app is implemented, this could cause problems, as the token exchange process breaks down. The app would have to ask the user to authenticate again.