diff --git a/git-commit b/git-commit
index 6c731699e52707abbb4d394ac9d0ff4325067e03..0facadba6b73ffc26c9415a58900c325cd230522 100644
--- a/git-commit
+++ b/git-commit
@@ -1 +1 @@
-8fc687c6fb64e110866466035e90c718d58f2c7f
+288b7252b0db60842f5d7e1b9716c84c98f4ea30
diff --git a/patch/0039-runc-fix-CVE-2024-3154.patch b/patch/0039-runc-fix-CVE-2024-3154.patch
new file mode 100644
index 0000000000000000000000000000000000000000..baabd2f027b25cdc07a0680bb0d46d550056ff6b
--- /dev/null
+++ b/patch/0039-runc-fix-CVE-2024-3154.patch
@@ -0,0 +1,47 @@
+From 3107921b5e32c860e476fe413dcd70174dd38401 Mon Sep 17 00:00:00 2001
+From: zhongjiawei <zhongjiawei1@huawei.com>
+Date: Thu, 23 May 2024 19:15:34 +0800
+Subject: [PATCH] features: implement returning
+ potentiallyUnsafeConfigAnnotations list
+
+---
+ features.go                | 5 +++++
+ types/features/features.go | 6 ++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/features.go b/features.go
+index c9cd15c..7f76e7a 100644
+--- a/features.go
++++ b/features.go
+@@ -55,6 +55,11 @@ var featuresCommand = cli.Command{
+ 					Enabled: &tru,
+ 				},
+ 			},
++			PotentiallyUnsafeConfigAnnotations: []string{
++				"bundle",
++				"org.systemd.property.", // prefix form
++				"org.criu.config",
++			},
+ 		}
+ 
+ 		if seccomp.Enabled {
+diff --git a/types/features/features.go b/types/features/features.go
+index c6269ca..8b467f7 100644
+--- a/types/features/features.go
++++ b/types/features/features.go
+@@ -25,6 +25,12 @@ type Features struct {
+ 	// Annotations contains implementation-specific annotation strings,
+ 	// such as the implementation version, and third-party extensions.
+ 	Annotations map[string]string `json:"annotations,omitempty"`
++
++	// PotentiallyUnsafeConfigAnnotations the list of the potential unsafe annotations
++	// that may appear in `config.json`.
++	//
++	// A value that ends with "." is interpreted as a prefix of annotations.
++	PotentiallyUnsafeConfigAnnotations []string `json:"potentiallyUnsafeConfigAnnotations,omitempty"`
+ }
+ 
+ // Linux is specific to Linux.
+-- 
+2.33.0
+
diff --git a/runc.spec b/runc.spec
index e7407f3da2774ed13d81e5d7fb612cf7cf704acb..cbab51e149210ac3b4dda7b98b3057846b7a8bee 100644
--- a/runc.spec
+++ b/runc.spec
@@ -3,7 +3,7 @@
 
 Name: runc
 Version: 1.1.8
-Release: 14
+Release: 15
 Summary: runc is a CLI tool for spawning and running containers according to the OCI specification.
 
 License: ASL 2.0
@@ -57,6 +57,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc
 %{_bindir}/runc
 
 %changelog
+* Fri May 24 2024 zhongjiawei<zhongjiawei1@huawei.com> - 1.1.8-15
+- Type:CVE
+- CVE:CVE-2024-3154
+- SUG:NA
+- DESC:fix CVE-2024-3154
+
 * Wed Apr 17 2024 Huang Yang <huangyang@loongson.cn> - 1.1.8-14
 - Type:bugfix
 - CVE:NA
diff --git a/series.conf b/series.conf
index 6674de184ace94827ae2f39d4c80b02485204524..681bf5b7d047733d03a0c4b3a448e78259964679 100644
--- a/series.conf
+++ b/series.conf
@@ -35,3 +35,4 @@ patch/0035-runc-Fix-undefined-behavior.patch
 patch/0036-runc-increase-the-number-of-cgroup-deletion-retries.patch
 patch/0037-runc-fix-CVE-2024-21626.patch
 patch/0038-runc-check-cmd-exist.patch
+patch/0039-runc-fix-CVE-2024-3154.patch