diff --git a/perl-5.25.2-perl-128238-Crash-with-non-stash-in-stash.patch b/perl-5.25.2-perl-128238-Crash-with-non-stash-in-stash.patch
new file mode 100644
index 0000000..b6f007e
--- /dev/null
+++ b/perl-5.25.2-perl-128238-Crash-with-non-stash-in-stash.patch
@@ -0,0 +1,66 @@
+From 9e5cda6b852ca831004628051cf32c1576146452 Mon Sep 17 00:00:00 2001
+From: Father Chrysostomos <sprout@cpan.org>
+Date: Thu, 23 Jun 2016 21:57:09 -0700
+Subject: [PATCH] [perl #128238] Crash with non-stash in stash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is a follow-up to e7acdfe976f.  Even if the name of the stash
+entry ends with ::, it may not itself contain a real stash (though
+this only happens with code that assigns directly to stash entries,
+which has undefined behaviour according to perlmod), so skip hashes
+that are not stashes.
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ gv.c         |  4 ++--
+ t/op/stash.t | 11 +++++++++--
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/gv.c b/gv.c
+index 2b3bdfa..dff611e 100644
+--- a/gv.c
++++ b/gv.c
+@@ -2411,10 +2411,10 @@ Perl_gv_check(pTHX_ HV *stash)
+ 
+     PERL_ARGS_ASSERT_GV_CHECK;
+ 
+-    if (!HvARRAY(stash))
++    if (!SvOOK(stash))
+ 	return;
+ 
+-    assert(SvOOK(stash));
++    assert(HvARRAY(stash));
+ 
+     for (i = 0; i <= (I32) HvMAX(stash); i++) {
+         const HE *entry;
+diff --git a/t/op/stash.t b/t/op/stash.t
+index 1591dbf..fe42700 100644
+--- a/t/op/stash.t
++++ b/t/op/stash.t
+@@ -7,7 +7,7 @@ BEGIN {
+ 
+ BEGIN { require "./test.pl"; }
+ 
+-plan( tests => 53 );
++plan( tests => 54 );
+ 
+ # Used to segfault (bug #15479)
+ fresh_perl_like(
+@@ -342,4 +342,11 @@ is runperl(
+     stderr => 1,
+    ),
+    "ok\n",
+-   "[perl #128238] don't treat %: as a stash (needs 2 colons)"
++   "[perl #128238] don't treat %: as a stash (needs 2 colons)";
++
++is runperl(
++    prog => 'BEGIN { $::{q|foo::|}=*ENV; $^W=1}; print qq|ok\n|',
++    stderr => 1,
++   ),
++   "ok\n",
++   "[perl #128238] non-stashes in stashes";
+-- 
+2.5.5
+
diff --git a/perl.spec b/perl.spec
index 666d180..870611a 100644
--- a/perl.spec
+++ b/perl.spec
@@ -28,7 +28,7 @@
 Name:           perl
 Version:        %{perl_version}
 # release number must be even higher, because dual-lived modules will be broken otherwise
-Release:        368%{?dist}
+Release:        369%{?dist}
 Epoch:          %{perl_epoch}
 Summary:        Practical Extraction and Report Language
 Group:          Development/Languages
@@ -135,6 +135,10 @@ Patch35:        perl-5.25.0-Fix-precedence-in-hv_ename_delete.patch
 # Do not treat %: as a stash, RT#128238, in upstream after 5.25.2
 Patch36:        perl-5.25.2-only-treat-stash-entries-with-.-as-sub-stashes.patch
 
+# Do not crash when inserting a non-stash into a stash, RT#128238,
+# in upstream after 5.25.2
+Patch37:        perl-5.25.2-perl-128238-Crash-with-non-stash-in-stash.patch
+
 # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
 Patch200:       perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
 
@@ -2790,6 +2794,7 @@ Perl extension for Version Objects
 %patch34 -p1
 %patch35 -p1
 %patch36 -p1
+%patch37 -p1
 %patch200 -p1
 %patch201 -p1
 
@@ -2817,6 +2822,7 @@ perl -x patchlevel.h \
     'Fedora Patch34: Do not use unitialized memory in $h{\const} warnings (RT#128189)' \
     'Fedora Patch35: Fix precedence in hv_ename_delete (RT#128086)' \
     'Fedora Patch36: Do not treat %: as a stash (RT#128238)' \
+    'Fedora Patch37: Do not crash when inserting a non-stash into a stash (RT#128238)' \
     'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
     'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
     %{nil}
@@ -5083,6 +5089,9 @@ popd
 
 # Old changelog entries are preserved in CVS.
 %changelog
+* Fri Jun 24 2016 Petr Pisar <ppisar@redhat.com> - 4:5.24.0-369
+- Do not crash when inserting a non-stash into a stash (RT#128238)
+
 * Wed Jun 22 2016 Petr Pisar <ppisar@redhat.com> - 4:5.24.0-368
 - Do not use unitialized memory in $h{\const} warnings (RT#128189)
 - Fix precedence in hv_ename_delete (RT#128086)