--- a/sys/platform/pc64/x86_64/identcpu.c
+++ b/sys/platform/pc64/x86_64/identcpu.c
@@ -672,8 +672,9 @@ identify_cpu(void)
 		 * Some hypervisors fail to filter out unsupported
 		 * extended features.  For now, disable the
 		 * extensions, activation of which requires setting a
 		 * bit in CR4, and which VM monitors do not support.
 		 */
 		if (cpu_feature2 & CPUID2_VMM) {
 			cpu_stdext_disable = CPUID_STDEXT_FSGSBASE |
 					     CPUID_STDEXT_SMEP |
+					     CPUID_STDEXT_SMAP;
 		} else {
 			cpu_stdext_disable = 0;
 		}