diff --git a/debian/changelog b/debian/changelog
index 80a9076e1..b1136e331 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -392,6 +392,9 @@ linux (4.9.25-1) UNRELEASED; urgency=medium
   * udeb: Add tifm_7xx1 to mmc-modules (Closes: #861195)
   * leds: Enable LEDS_GPIO as module for all configurations with GPIOs
     (Closes: #860569)
+  * selinux: Set SECURITY_SELINUX_CHECKREQPROT_VALUE=0, per default.
+    This may break some old applications if SELinux is enabled, and can be
+    reverted using the kernel parameter: checkreqprot=1
 
   [ Salvatore Bonaccorso ]
   * ping: implement proper locking (CVE-2017-2671)
diff --git a/debian/config/config b/debian/config/config
index e65fe0ff2..55df382cf 100644
--- a/debian/config/config
+++ b/debian/config/config
@@ -7147,7 +7147,7 @@ CONFIG_SECURITY_SELINUX=y
 # CONFIG_SECURITY_SELINUX_DISABLE is not set
 CONFIG_SECURITY_SELINUX_DEVELOP=y
 CONFIG_SECURITY_SELINUX_AVC_STATS=y
-CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
+CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=0
 
 ##
 ## file: security/smack/Kconfig