diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c
index 74aa075ba1..07ccae3bbd 100644
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -2131,12 +2131,10 @@ static void svm_vmexit_ud_intercept(struct cpu_user_regs *regs)
 
     if ( opt_hvm_fep )
     {
-        uint32_t walk = (ctxt.seg_reg[x86_seg_ss].attr.fields.dpl == 3)
-            ? PFEC_user_mode : 0;
         char sig[5]; /* ud2; .ascii "xen" */
 
         if ( (hvm_fetch_from_guest_virt_nofault(
-                  sig, regs->eip, sizeof(sig), walk) == HVMCOPY_okay) &&
+                  sig, regs->eip, sizeof(sig), 0) == HVMCOPY_okay) &&
              (memcmp(sig, "\xf\xbxen", sizeof(sig)) == 0) )
         {
             regs->eip += sizeof(sig);
diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 7f96ad64e5..698c90663e 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -2763,12 +2763,10 @@ static void vmx_vmexit_ud_intercept(struct cpu_user_regs *regs)
 
     if ( opt_hvm_fep )
     {
-        uint32_t walk = (ctxt.seg_reg[x86_seg_ss].attr.fields.dpl == 3)
-            ? PFEC_user_mode : 0;
         char sig[5]; /* ud2; .ascii "xen" */
 
         if ( (hvm_fetch_from_guest_virt_nofault(
-                  sig, regs->eip, sizeof(sig), walk) == HVMCOPY_okay) &&
+                  sig, regs->eip, sizeof(sig), 0) == HVMCOPY_okay) &&
              (memcmp(sig, "\xf\xbxen", sizeof(sig)) == 0) )
         {
             regs->eip += sizeof(sig);