diff --git a/debian/changelog b/debian/changelog
index ec9e79fe7..8a84d57d1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+linux (4.19.28-2) UNRELEASED; urgency=medium
+
+  * [x86,alpha,m68k] binfmt: Disable BINFMT_AOUT, IA32_AOUT, OSF4_COMPAT
+
+ -- Ben Hutchings <ben@decadent.org.uk>  Tue, 12 Mar 2019 15:44:31 +0000
+
 linux (4.19.28-1) unstable; urgency=medium
 
   * New upstream stable update:
diff --git a/debian/config/alpha/config b/debian/config/alpha/config
index 499a3f1eb..47a119973 100644
--- a/debian/config/alpha/config
+++ b/debian/config/alpha/config
@@ -904,8 +904,6 @@ CONFIG_USBPCWATCHDOG=m
 ##
 ## file: fs/Kconfig.binfmt
 ##
-CONFIG_BINFMT_AOUT=m
-CONFIG_OSF4_COMPAT=y
 # CONFIG_BINFMT_EM86 is not set
 
 ##
diff --git a/debian/config/amd64/config b/debian/config/amd64/config
index 0f9e2c17e..4ffe17e12 100644
--- a/debian/config/amd64/config
+++ b/debian/config/amd64/config
@@ -33,6 +33,7 @@ CONFIG_LEGACY_VSYSCALL_NONE=y
 ## end choice
 CONFIG_PCI_MMCONFIG=y
 CONFIG_ISA_DMA_API=y
+# CONFIG_IA32_AOUT is not set
 CONFIG_X86_X32=y
 CONFIG_X86_X32_DISABLED=y
 
diff --git a/debian/config/amd64/config.cloud-amd64 b/debian/config/amd64/config.cloud-amd64
index 3a386e0c7..faec4f5b9 100644
--- a/debian/config/amd64/config.cloud-amd64
+++ b/debian/config/amd64/config.cloud-amd64
@@ -18,7 +18,6 @@
 # CONFIG_ISA_DMA_API is not set
 # CONFIG_ISA is not set
 # CONFIG_EISA is not set
-# CONFIG_IA32_AOUT is not set
 # CONFIG_X86_X32 is not set
 
 ##
diff --git a/debian/config/config b/debian/config/config
index 888c785d3..08bee25b9 100644
--- a/debian/config/config
+++ b/debian/config/config
@@ -5772,6 +5772,7 @@ CONFIG_BFS_FS=m
 CONFIG_BINFMT_ELF=y
 CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
 CONFIG_BINFMT_SCRIPT=y
+# CONFIG_BINFMT_AOUT is not set
 CONFIG_BINFMT_MISC=m
 CONFIG_COREDUMP=y
 
diff --git a/debian/config/i386/config b/debian/config/i386/config
index e15231f33..2beee8808 100644
--- a/debian/config/i386/config
+++ b/debian/config/i386/config
@@ -465,11 +465,6 @@ CONFIG_PCWATCHDOG=m
 CONFIG_MIXCOMWD=m
 CONFIG_WDT=m
 
-##
-## file: fs/Kconfig.binfmt
-##
-CONFIG_BINFMT_AOUT=m
-
 ##
 ## file: kernel/irq/Kconfig
 ##
diff --git a/debian/config/kernelarch-x86/config b/debian/config/kernelarch-x86/config
index beae121bb..1ba2e0406 100644
--- a/debian/config/kernelarch-x86/config
+++ b/debian/config/kernelarch-x86/config
@@ -80,7 +80,6 @@ CONFIG_PCI=y
 #. Doesn't support handover; see #822575
 # CONFIG_X86_SYSFB is not set
 CONFIG_IA32_EMULATION=y
-CONFIG_IA32_AOUT=y
 
 ##
 ## file: arch/x86/Kconfig.cpu
diff --git a/debian/config/m68k/config b/debian/config/m68k/config
index 9c5e78a38..64a96c3b8 100644
--- a/debian/config/m68k/config
+++ b/debian/config/m68k/config
@@ -633,7 +633,6 @@ CONFIG_ZORRO_NAMES=y
 ## file: fs/Kconfig.binfmt
 ##
 CONFIG_BINFMT_ELF=y
-CONFIG_BINFMT_AOUT=m
 CONFIG_BINFMT_MISC=m
 
 ##