diff --git a/Makefile.rhelver b/Makefile.rhelver
index 0d8b59780a..7fe937c393 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 10
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 553.144.1
+RHEL_RELEASE = 553.146.1
 
 #
 # ZSTREAM
diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
index 70540bddbd..2579d45f3a 100644
--- a/drivers/infiniband/hw/mana/qp.c
+++ b/drivers/infiniband/hw/mana/qp.c
@@ -239,11 +239,20 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
 
 		mana_ind_table[i] = wq->rx_object;
 
-		/* Create CQ table entry */
-		WARN_ON(gc->cq_table[cq->id]);
+		/* Create CQ table entry, sharing a CQ between WQs is not supported */
+		if (gc->cq_table[cq->id]) {
+			ret = -EINVAL;
+			/* Reset IDs to prevent mana_ib_destroy_cq from corrupting foreign entry */
+			wq->id = INVALID_QUEUE_ID;
+			cq->id = INVALID_QUEUE_ID;
+			goto fail;
+		}
 		gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
 		if (!gdma_cq) {
 			ret = -ENOMEM;
+			/* Reset IDs to prevent mana_ib_destroy_cq from corrupting foreign entry */
+			wq->id = INVALID_QUEUE_ID;
+			cq->id = INVALID_QUEUE_ID;
 			goto fail;
 		}
 		gdma_cq_allocated[i] = gdma_cq;
@@ -284,8 +293,11 @@ fail:
 		wq = container_of(ibwq, struct mana_ib_wq, ibwq);
 		cq = container_of(ibcq, struct mana_ib_cq, ibcq);
 
-		gc->cq_table[cq->id] = NULL;
-		kfree(gdma_cq_allocated[i]);
+		/* Only clear cq_table entry if we successfully allocated it */
+		if (gdma_cq_allocated[i]) {
+			gc->cq_table[cq->id] = NULL;
+			kfree(gdma_cq_allocated[i]);
+		}
 
 		mana_destroy_wq_obj(mpc, GDMA_RQ, wq->rx_object);
 	}
@@ -420,7 +432,10 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
 	send_cq->id = cq_spec.queue_index;
 
 	/* Create CQ table entry */
-	WARN_ON(gd->gdma_context->cq_table[send_cq->id]);
+	if (gd->gdma_context->cq_table[send_cq->id]) {
+		err = -EINVAL;
+		goto err_destroy_wq_obj;
+	}
 	gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
 	if (!gdma_cq) {
 		err = -ENOMEM;
diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
index af6191e9f6..fc75a61add 100644
--- a/drivers/pci/controller/vmd.c
+++ b/drivers/pci/controller/vmd.c
@@ -126,7 +126,7 @@ struct vmd_irq_list {
 struct vmd_dev {
 	struct pci_dev		*dev;
 
-	spinlock_t		cfg_lock;
+	raw_spinlock_t		cfg_lock;
 	void __iomem		*cfgbar;
 
 	int msix_count;
@@ -396,7 +396,7 @@ static int vmd_pci_read(struct pci_bus *bus, unsigned int devfn, int reg,
 	if (!addr)
 		return -EFAULT;
 
-	spin_lock_irqsave(&vmd->cfg_lock, flags);
+	raw_spin_lock_irqsave(&vmd->cfg_lock, flags);
 	switch (len) {
 	case 1:
 		*value = readb(addr);
@@ -411,7 +411,7 @@ static int vmd_pci_read(struct pci_bus *bus, unsigned int devfn, int reg,
 		ret = -EINVAL;
 		break;
 	}
-	spin_unlock_irqrestore(&vmd->cfg_lock, flags);
+	raw_spin_unlock_irqrestore(&vmd->cfg_lock, flags);
 	return ret;
 }
 
@@ -431,7 +431,7 @@ static int vmd_pci_write(struct pci_bus *bus, unsigned int devfn, int reg,
 	if (!addr)
 		return -EFAULT;
 
-	spin_lock_irqsave(&vmd->cfg_lock, flags);
+	raw_spin_lock_irqsave(&vmd->cfg_lock, flags);
 	switch (len) {
 	case 1:
 		writeb(value, addr);
@@ -449,7 +449,7 @@ static int vmd_pci_write(struct pci_bus *bus, unsigned int devfn, int reg,
 		ret = -EINVAL;
 		break;
 	}
-	spin_unlock_irqrestore(&vmd->cfg_lock, flags);
+	raw_spin_unlock_irqrestore(&vmd->cfg_lock, flags);
 	return ret;
 }
 
@@ -1002,7 +1002,7 @@ static int vmd_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	if (features & VMD_FEAT_OFFSET_FIRST_VECTOR)
 		vmd->first_vec = 1;
 
-	spin_lock_init(&vmd->cfg_lock);
+	raw_spin_lock_init(&vmd->cfg_lock);
 	pci_set_drvdata(dev, vmd);
 	err = vmd_enable_domain(vmd, features);
 	if (err)
diff --git a/kernel.sbat b/kernel.sbat
index f3c8843efa..95b57c5694 100644
--- a/kernel.sbat
+++ b/kernel.sbat
@@ -1,2 +1,2 @@
 sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
-kernel.centos,1,Red Hat,kernel-core,4.18.0-553.144.1.el8.x86_64,mailto:secalert@redhat.com
+kernel.centos,1,Red Hat,kernel-core,4.18.0-553.146.1.el8.x86_64,mailto:secalert@redhat.com
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 447d4d3b3b..0e807ee52a 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6323,7 +6323,13 @@ static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
 		if (chan->ident != cmd->ident)
 			continue;
 
+		l2cap_chan_hold(chan);
+		l2cap_chan_lock(chan);
+
 		l2cap_chan_del(chan, ECONNRESET);
+
+		l2cap_chan_unlock(chan);
+		l2cap_chan_put(chan);
 	}
 
 	return 0;