Index: /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 19873)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 19874)
@@ -839,5 +839,9 @@
      * Call worker.
      */
-    return PGM_SHW_PFN(ModifyPage, pVCpu)(pVCpu, GCPtr, cb, fFlags, fMask);
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
+    pgmLock(pVM);
+    int rc = PGM_SHW_PFN(ModifyPage, pVCpu)(pVCpu, GCPtr, cb, fFlags, fMask);
+    pgmUnlock(pVM);
+    return rc;
 }
 
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllShw.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllShw.h	(revision 19873)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllShw.h	(revision 19874)
@@ -287,4 +287,5 @@
     int rc;
 
+    Assert(PGMIsLockOwner(pVM));
     /*
      * Walk page tables and pages till we're done.
@@ -356,5 +357,8 @@
             if (pPT->a[iPTE].n.u1Present)
             {
-                pPT->a[iPTE].u = (pPT->a[iPTE].u & (fMask | SHW_PTE_PG_MASK)) | (fFlags & ~SHW_PTE_PG_MASK);
+                SHWPTE Pte;
+
+                Pte.u = (pPT->a[iPTE].u & (fMask | SHW_PTE_PG_MASK)) | (fFlags & ~SHW_PTE_PG_MASK);
+                ASMAtomicWriteSize(&pPT->a[iPTE], Pte.u);
                 Assert(pPT->a[iPTE].n.u1Present);
 # if PGM_SHW_TYPE == PGM_TYPE_EPT