diff --git a/debian/rules b/debian/rules
index 29ff79fc9c16..85af06c7f560 100755
--- a/debian/rules
+++ b/debian/rules
@@ -213,6 +213,7 @@ $(DEBIAN)/control.stub: 				\
 .PHONY: debian/control
 debian/control: $(DEBIAN)/control.stub
 	cp $(DEBIAN)/control.stub debian/control
+	debian/scripts/checks/control-check
 
 debian/canonical-certs.pem: $(wildcard $(DROOT)/certs/*-all.pem) $(wildcard $(DROOT)/certs/*-$(arch).pem) $(wildcard $(DEBIAN)/certs/*-all.pem) $(wildcard $(DEBIAN)/certs/*-$(arch).pem)
 	for cert in $(sort $(notdir $^));					\
diff --git a/debian/scripts/checks/control-check b/debian/scripts/checks/control-check
new file mode 100755
index 000000000000..51e1c91f5502
--- /dev/null
+++ b/debian/scripts/checks/control-check
@@ -0,0 +1,36 @@
+#!/bin/bash -eu
+#
+# debian/control sanity checks
+#
+
+echo "II: Checking debian/control"
+
+. debian/debian.env
+
+source_name=$(dpkg-parsechangelog -l"${DEBIAN}"/changelog -SSource)
+linux_source=$(grep -P '^Package:\s*linux.*-source-\d+\.\d+\.\d+' debian/control | sed 's/^Package:\s*//')
+
+case "${source_name}___${linux_source}" in
+	linux___linux-source-*)
+		# Main kernel package produces linux-source
+		true
+		;;
+	linux-*___)
+		# Non-main kernel package must *not* produce linux-source
+		true
+		;;
+	*)
+		# All other combinations are packaging mistakes
+		if [ -n "${linux_source}" ] ; then
+			echo "EE: debian/control contains invalid package stanza:" >&2
+			echo "Package: ${linux_source}" >&2
+		else
+			echo "EE: debian/control is missing package stanza:" >&2
+			echo "Package: linux-source-PKGVER" >&2
+		fi
+		exit 1
+		;;
+esac
+
+echo "II: Done"
+exit 0