diff --git a/perl-5.25.0-Fix-precedence-in-hv_ename_delete.patch b/perl-5.25.0-Fix-precedence-in-hv_ename_delete.patch
new file mode 100644
index 0000000..0d1d5b4
--- /dev/null
+++ b/perl-5.25.0-Fix-precedence-in-hv_ename_delete.patch
@@ -0,0 +1,82 @@
+From 60a26c797bbff039ea7f861903732e7cceae415a Mon Sep 17 00:00:00 2001
+From: Hugo van der Sanden <hv@crypt.org>
+Date: Sun, 15 May 2016 13:48:58 -0700
+Subject: [PATCH 1/2] [perl #128086] Fix precedence in hv_ename_delete
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A stash’s array of names may have null for the first entry, in which
+case it is not one of the effective names, and the name count will
+be negative.
+
+The ‘count > 0’ is meant to prevent hv_ename_delete from trying to
+read that entry, but a precedence problem introduced in 4643eb699
+stopped it from doing that.
+
+[This commit message was written by the committer.]
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ hv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hv.c b/hv.c
+index 7b5ad95..5523475 100644
+--- a/hv.c
++++ b/hv.c
+@@ -2476,9 +2476,10 @@ Perl_hv_ename_delete(pTHX_ HV *hv, const char *name, U32 len, U32 flags)
+ 		return;
+ 	    }
+ 	if (
+-	    count > 0 && (HEK_UTF8(*namep) || (flags & SVf_UTF8)) 
++	    count > 0 && ((HEK_UTF8(*namep) || (flags & SVf_UTF8)) 
+                 ? hek_eq_pvn_flags(aTHX_ *namep, name, (I32)len, flags)
+ 	        : (HEK_LEN(*namep) == (I32)len && memEQ(HEK_KEY(*namep), name, len))
++            )
+ 	) {
+ 	    aux->xhv_name_count = -count;
+ 	}
+-- 
+2.5.5
+
+From 7f1bd063e5aa5aeb26ed9c39db6864cc0ecd7a73 Mon Sep 17 00:00:00 2001
+From: Father Chrysostomos <sprout@cpan.org>
+Date: Sun, 15 May 2016 13:49:33 -0700
+Subject: [PATCH 2/2] [perl #128086] Test the prev commit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ t/op/stash.t | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/t/op/stash.t b/t/op/stash.t
+index 151b729..b8e0f34 100644
+--- a/t/op/stash.t
++++ b/t/op/stash.t
+@@ -7,7 +7,7 @@ BEGIN {
+ 
+ BEGIN { require "./test.pl"; }
+ 
+-plan( tests => 51 );
++plan( tests => 52 );
+ 
+ # Used to segfault (bug #15479)
+ fresh_perl_like(
+@@ -334,3 +334,10 @@ is runperl(
+    ),
+    "ok\n",
+    '[perl #123847] no crash from *foo::=*bar::=*glob_with_hash';
++
++is runperl(
++    prog => '%h; *::::::=*h; delete $::{q|::|}; print qq|ok\n|',
++    stderr => 1,
++   ),
++   "ok\n",
++   '[perl #128086] no crash from assigning hash to *:::::: & deleting it';
+-- 
+2.5.5
+
diff --git a/perl.spec b/perl.spec
index 942e0ee..15c9308 100644
--- a/perl.spec
+++ b/perl.spec
@@ -129,6 +129,9 @@ Patch33:        perl-5.24.0-fix-128109-do-not-move-RExC_open_parens-0-in-reginse
 # in upstream after 5.25.2
 Patch34:        perl-5.25.2-uninit-warning-from-h-const-coredumped.patch
 
+# Fix precedence in hv_ename_delete, RT#128086, in upstream after 5.25.0
+Patch35:        perl-5.25.0-Fix-precedence-in-hv_ename_delete.patch
+
 # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
 Patch200:       perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
 
@@ -2782,6 +2785,7 @@ Perl extension for Version Objects
 %patch32 -p1
 %patch33 -p1
 %patch34 -p1
+%patch35 -p1
 %patch200 -p1
 %patch201 -p1
 
@@ -2807,6 +2811,7 @@ perl -x patchlevel.h \
     'Fedora Patch32: Do not mangle errno from failed socket calls (RT#128316)' \
     'Fedora Patch33: Fix compiling regular expressions like /\X*(?0)/ (RT#128109)' \
     'Fedora Patch34: Do not use unitialized memory in $h{\const} warnings (RT#128189)' \
+    'Fedora Patch35: Fix precedence in hv_ename_delete (RT#128086)' \
     'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
     'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
     %{nil}
@@ -5075,6 +5080,7 @@ popd
 %changelog
 * Wed Jun 22 2016 Petr Pisar <ppisar@redhat.com> - 4:5.24.0-368
 - Do not use unitialized memory in $h{\const} warnings (RT#128189)
+- Fix precedence in hv_ename_delete (RT#128086)
 
 * Mon Jun 20 2016 Petr Pisar <ppisar@redhat.com> - 4:5.24.0-367
 - Fix compiling regular expressions like /\X*(?0)/ (RT#128109)