diff --git a/containerd.spec b/containerd.spec
index 6f7e08a30335ecb768aaee096f0284052ed935cb..b2087d182ca027d65ed48324f9b06dd7890a7466 100644
--- a/containerd.spec
+++ b/containerd.spec
@@ -2,7 +2,7 @@
 %global debug_package %{nil}
 Version:        1.2.0
 Name:           containerd
-Release:        300
+Release:        301
 Summary:        An industry-standard container runtime
 License:        ASL 2.0
 URL:            https://containerd.io
@@ -52,6 +52,12 @@ install -p -m 755 bin/containerd-shim $RPM_BUILD_ROOT/%{_bindir}/containerd-shim
 %{_bindir}/containerd-shim
 
 %changelog
+* Tue May 10 2022 Vanient<xiadanni1@huawei.com> - 1.2.0-301
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:Use fs.RootPath when mounting volumes for bundle dir to fix CVE-2022-23648
+
 * Sat Jan 22 2022 songyanting<songyanting@huawei.com> - 1.2.0-300
 - Type:bugfix
 - ID:NA
diff --git a/git-commit b/git-commit
index cbf866b0473894f462adbb519e0fe96c406453f3..7a61d603493233d19a7421c273801b495e31f177 100644
--- a/git-commit
+++ b/git-commit
@@ -1 +1 @@
-f9c6fe2f3c5ccd74691119b99dbf59096aa14249
+188e768fc5b6e679728ee1e7033e481b238b4665
diff --git a/patch/0084-containerd-Use-fs.RootPath-when-mounting-vo.patch b/patch/0084-containerd-Use-fs.RootPath-when-mounting-vo.patch
new file mode 100644
index 0000000000000000000000000000000000000000..130d407bc0f9198674ebd0cbee2dd4afccdd90b0
--- /dev/null
+++ b/patch/0084-containerd-Use-fs.RootPath-when-mounting-vo.patch
@@ -0,0 +1,40 @@
+From 53c45a7abaea09e60e0175f192742c74d1be60e2 Mon Sep 17 00:00:00 2001
+From: Vanient <xiadanni1@huawei.com>
+Date: Thu, 31 Mar 2022 21:30:15 +0800
+Subject: [PATCH] containerd:Use fs.RootPath when mounting volumes
+
+fix CVE-2022-23648
+upstream:https://github.com/containerd/containerd/commit/3406af86394c2426ce7f55d5f52be2b79f456211
+
+Signed-off-by: Vanient <xiadanni1@huawei.com>
+---
+ .../containerd/cri/pkg/containerd/opts/container.go         | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/vendor/github.com/containerd/cri/pkg/containerd/opts/container.go b/vendor/github.com/containerd/cri/pkg/containerd/opts/container.go
+index 7647c373c..2ea49b594 100644
+--- a/vendor/github.com/containerd/cri/pkg/containerd/opts/container.go
++++ b/vendor/github.com/containerd/cri/pkg/containerd/opts/container.go
+@@ -20,7 +20,6 @@ import (
+ 	"context"
+ 	"io/ioutil"
+ 	"os"
+-	"path/filepath"
+ 
+ 	"github.com/containerd/containerd"
+ 	"github.com/containerd/containerd/containers"
+@@ -88,7 +87,10 @@ func WithVolumes(volumeMounts map[string]string) containerd.NewContainerOpts {
+ 		}()
+ 
+ 		for host, volume := range volumeMounts {
+-			src := filepath.Join(root, volume)
++			src, err := fs.RootPath(root, volume)
++			if err != nil {
++				return errors.Wrapf(err, "rootpath on root %s, volume %s", root, volume)
++			}
+ 			if _, err := os.Stat(src); err != nil {
+ 				if os.IsNotExist(err) {
+ 					// Skip copying directory if it does not exist.
+-- 
+2.27.0
+
diff --git a/series.conf b/series.conf
index 28222126136d315a11aa974c6589f5863b8d6d43..5645ef4d208cdf8337ddf548c8e8bcf5b3a6a48d 100644
--- a/series.conf
+++ b/series.conf
@@ -88,4 +88,5 @@ patch/0080-containerd-improve-log-for-debugging.patch
 patch/0081-containerd-reduce-permissions-for-bundle-di.patch
 patch/0082-containerd-fix-publish-command-wait-block-for.patch
 patch/0083-containerd-optimize-cgo-compile-options.patch
+patch/0084-containerd-Use-fs.RootPath-when-mounting-vo.patch
 # end