Index: /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 61629)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 61630)
@@ -3535,4 +3535,7 @@
          */
 
+        /* Set the new CPL so that stack accesses use it. */
+        pIemCpu->uCpl = uNewCpl;
+
         /* Create the stack frame. */
         RTPTRUNION uStackFrame;
@@ -3547,5 +3550,5 @@
                 *uStackFrame.pu32++ = uErr;
             uStackFrame.pu32[0] = (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT) ? pCtx->eip + cbInstr : pCtx->eip;
-            uStackFrame.pu32[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | pIemCpu->uCpl;
+            uStackFrame.pu32[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | (pCtx->ss.Sel & X86_SEL_RPL);
             uStackFrame.pu32[2] = fEfl;
             uStackFrame.pu32[3] = pCtx->esp;
@@ -3565,5 +3568,5 @@
                 *uStackFrame.pu16++ = uErr;
             uStackFrame.pu16[0] = (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT) ? pCtx->ip + cbInstr : pCtx->ip;
-            uStackFrame.pu16[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | pIemCpu->uCpl;
+            uStackFrame.pu16[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | (pCtx->ss.Sel & X86_SEL_RPL);
             uStackFrame.pu16[2] = fEfl;
             uStackFrame.pu16[3] = pCtx->sp;