diff --git a/kata-containers.spec b/kata-containers.spec
index 1b6394b0ad10525c92a8b85632bcaa41c943ba3a..9c52cc43c510cd768dd1929ae4b48e5b460d0a49 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -2,7 +2,7 @@
 %global debug_package %{nil}
 
 %define VERSION 1.11.1
-%define RELEASE 27
+%define RELEASE 28
 
 Name:           kata-containers
 Version:        %{VERSION}
@@ -98,6 +98,12 @@ install -p -m 640 -D ./runtime/cli/config/configuration-qemu.toml %{buildroot}/u
 %doc
 
 %changelog
+* Fri Oct 24 2025 dongyuzhen <dongyuzhen@h-partners.com> - 1.11.1-28
+- Type:CVE
+- ID:NA
+- SUG:NA
+- DESC:fix CVE-2020-27151
+
 * Wed Oct 15 2025 dongyuzhen <dongyuzhen@h-partners.com> - 1.11.1-27
 - Type:enhancement
 - ID:NA
diff --git a/runtime/patches/0099-fix-CVE-2020-27151.patch b/runtime/patches/0099-fix-CVE-2020-27151.patch
new file mode 100644
index 0000000000000000000000000000000000000000..5abb9301ab9a862f8f6ecbe26de83f0a59d36b1d
--- /dev/null
+++ b/runtime/patches/0099-fix-CVE-2020-27151.patch
@@ -0,0 +1,34 @@
+From 0cba3754fca32e1135eadfacb6268af3dd4e3afc Mon Sep 17 00:00:00 2001
+From: dongyuzhen <dongyuzhen@h-partners.com>
+Date: Fri, 24 Oct 2025 16:15:18 +0800
+Subject: [PATCH] fix CVE-2020-27151
+
+---
+ virtcontainers/pkg/oci/utils.go | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/virtcontainers/pkg/oci/utils.go b/virtcontainers/pkg/oci/utils.go
+index 7305c65..0ecac68 100644
+--- a/virtcontainers/pkg/oci/utils.go
++++ b/virtcontainers/pkg/oci/utils.go
+@@ -571,7 +571,7 @@ func addHypervisorMemoryOverrides(ocispec specs.Spec, sbConfig *vc.SandboxConfig
+ 	}
+ 
+ 	if value, ok := ocispec.Annotations[vcAnnotations.FileBackedMemRootDir]; ok {
+-		sbConfig.HypervisorConfig.FileBackedMemRootDir = value
++		logrus.Warnf("the file_mem_backend annotation is not supported (value: %s)", value)
+ 	}
+ 
+ 	if value, ok := ocispec.Annotations[vcAnnotations.HugePages]; ok {
+@@ -706,7 +706,7 @@ func addHypervisporVirtioFsOverrides(ocispec specs.Spec, sbConfig *vc.SandboxCon
+ 	}
+ 
+ 	if value, ok := ocispec.Annotations[vcAnnotations.VirtioFSDaemon]; ok {
+-		sbConfig.HypervisorConfig.VirtioFSDaemon = value
++		logrus.Warnf("the virtio_fs_daemon annotation is not supported (value: %s)", value)
+ 	}
+ 
+ 	if sbConfig.HypervisorConfig.SharedFS == config.VirtioFS && sbConfig.HypervisorConfig.VirtioFSDaemon == "" {
+-- 
+2.43.0
+
diff --git a/runtime/series.conf b/runtime/series.conf
index c54d65e5e2fd5a8d97df347fd308ec085b6b414a..30c5a61695b88b85fc4351489422437bd8df12ac 100644
--- a/runtime/series.conf
+++ b/runtime/series.conf
@@ -96,3 +96,4 @@
 0096-kata-containers-Move-from-query-cpus-to-query-cpus-f.patch
 0097-kata-runtime-add-timeout-for-all-qmp-commands.patch
 0098-kata-runtime-remove-kernel_irqchip-option.patch
+0099-fix-CVE-2020-27151.patch