diff --git a/perl-5.27.0-perl-131085-Crash-with-sub-in-stash.patch b/perl-5.27.0-perl-131085-Crash-with-sub-in-stash.patch
new file mode 100644
index 0000000..4613f00
--- /dev/null
+++ b/perl-5.27.0-perl-131085-Crash-with-sub-in-stash.patch
@@ -0,0 +1,53 @@
+From 790acddeaa0d2c73524596048b129561225cf100 Mon Sep 17 00:00:00 2001
+From: Father Chrysostomos <sprout@cpan.org>
+Date: Fri, 7 Apr 2017 14:08:02 -0700
+Subject: [PATCH] [perl #131085] Crash with sub-in-stash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+$ perl -e '$::{"A"} = sub {}; \&{"A"}'
+Segmentation fault (core dumped)
+
+The code that vivifies a typeglob out of a code ref assumed that the
+CV had a name hek, which is always the case when perl itself puts the
+code ref there (via ‘sub A{}’), but is not necessarily the case if
+someone is insinuating other stuff into the stash.
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ gv.c      | 2 +-
+ t/op/gv.t | 4 ++++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/gv.c b/gv.c
+index d32a9c5..315ec49 100644
+--- a/gv.c
++++ b/gv.c
+@@ -421,7 +421,7 @@ Perl_gv_init_pvn(pTHX_ GV *gv, HV *stash, const char *name, STRLEN len, U32 flag
+ 	/* Not actually a constant.  Just a regular sub.  */
+ 	CV * const cv = (CV *)has_constant;
+ 	GvCV_set(gv,cv);
+-	if (CvSTASH(cv) == stash && (
++	if (CvNAMED(cv) && CvSTASH(cv) == stash && (
+ 	       CvNAME_HEK(cv) == GvNAME_HEK(gv)
+ 	    || (  HEK_LEN(CvNAME_HEK(cv)) == HEK_LEN(GvNAME_HEK(gv))
+ 	       && HEK_FLAGS(CvNAME_HEK(cv)) != HEK_FLAGS(GvNAME_HEK(gv))
+diff --git a/t/op/gv.t b/t/op/gv.t
+index 8d5e7dc..4fe6b00 100644
+--- a/t/op/gv.t
++++ b/t/op/gv.t
+@@ -1187,6 +1187,10 @@ package GV_DOWNGRADE {
+     ::like "$GV_DOWNGRADE::{FOO}", qr/SCALAR/, "gv_downgrade: post";
+ }
+ 
++# [perl #131085] This used to crash; no ok() necessary.
++$::{"A131085"} = sub {}; \&{"A131085"};
++
++
+ __END__
+ Perl
+ Rules
+-- 
+2.9.4
+
diff --git a/perl.spec b/perl.spec
index 11c5b98..2e5a5a2 100644
--- a/perl.spec
+++ b/perl.spec
@@ -141,6 +141,10 @@ Patch30:        perl-5.22.1-Replace-EU-MM-dependnecy-with-EU-MM-Utils-in-IPC-Cmd
 # in upstream after 5.27.0
 Patch31:        perl-5.27.0-perl-131211-fixup-File-Glob-degenerate-matching.patch
 
+# Fix a crash when calling a subroutine from a stash, RT#131085,
+# in upstream after 5.27.0
+Patch32:        perl-5.27.0-perl-131085-Crash-with-sub-in-stash.patch
+
 # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
 Patch200:       perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
 
@@ -2790,6 +2794,7 @@ Perl extension for Version Objects
 %patch26 -p1
 %patch30 -p1
 %patch31 -p1
+%patch32 -p1
 %patch200 -p1
 %patch201 -p1
 
@@ -2811,6 +2816,7 @@ perl -x patchlevel.h \
     'Fedora Patch27: Make PadlistNAMES() lvalue again (CPAN RT#101063)' \
     'Fedora Patch30: Replace EU::MakeMaker dependency with EU::MM::Utils in IPC::Cmd (bug #1129443)' \
     'Fedora Patch31: Make File::Glob more resistant against degenerative matching (RT#131211)' \
+    'Fedora Patch32: Fix a crash when calling a subroutine from a stash (RT#131085)' \
     'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
     'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
     %{nil}
@@ -5095,6 +5101,7 @@ popd
 %changelog
 * Fri Jun 16 2017 Petr Pisar <ppisar@redhat.com> - 4:5.26.0-394
 - Make File::Glob more resistant against degenerative matching (RT#131211)
+- Fix a crash when calling a subroutine from a stash (RT#131085)
 
 * Tue Jun 06 2017 Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.0-393
 - Stop providing old perl(MODULE_COMPAT_5.24.*)