diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index a812ef0244..6fb8c92543 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -5532,8 +5532,7 @@ int modify_xen_mappings(unsigned long s, unsigned long e, unsigned int nf)
 {
     bool locking = system_state > SYS_STATE_boot;
     l3_pgentry_t *pl3e = NULL;
-    l2_pgentry_t *pl2e;
-    l1_pgentry_t *pl1e;
+    l2_pgentry_t *pl2e = NULL;
     unsigned int  i;
     unsigned long v = s;
     int rc = -ENOMEM;
@@ -5614,7 +5613,8 @@ int modify_xen_mappings(unsigned long s, unsigned long e, unsigned int nf)
          * The L3 entry has been verified to be present, and we've dealt with
          * 1G pages as well, so the L2 table cannot require allocation.
          */
-        pl2e = l3e_to_l2e(*pl3e) + l2_table_offset(v);
+        pl2e = map_xen_pagetable_new(l3e_get_mfn(*pl3e));
+        pl2e += l2_table_offset(v);
 
         if ( !(l2e_get_flags(*pl2e) & _PAGE_PRESENT) )
         {
@@ -5678,14 +5678,16 @@ int modify_xen_mappings(unsigned long s, unsigned long e, unsigned int nf)
         }
         else
         {
-            l1_pgentry_t nl1e, *l1t;
+            l1_pgentry_t nl1e, *l1t, *pl1e;
+            mfn_t l1t_mfn;
 
             /*
              * Ordinary 4kB mapping: The L2 entry has been verified to be
              * present, and we've dealt with 2M pages as well, so the L1 table
              * cannot require allocation.
              */
-            pl1e = l2e_to_l1e(*pl2e) + l1_table_offset(v);
+            pl1e = map_xen_pagetable_new(l2e_get_mfn(*pl2e));
+            pl1e += l1_table_offset(v);
 
             /* Confirm the caller isn't trying to create new mappings. */
             if ( !(l1e_get_flags(*pl1e) & _PAGE_PRESENT) )
@@ -5696,6 +5698,7 @@ int modify_xen_mappings(unsigned long s, unsigned long e, unsigned int nf)
                                (l1e_get_flags(*pl1e) & ~FLAGS_MASK) | nf);
 
             l1e_write_atomic(pl1e, nl1e);
+            UNMAP_XEN_PAGETABLE_NEW(pl1e);
             v += PAGE_SIZE;
 
             /*
@@ -5725,10 +5728,12 @@ int modify_xen_mappings(unsigned long s, unsigned long e, unsigned int nf)
                 goto end_of_loop;
             }
 
-            l1t = l2e_to_l1e(*pl2e);
+            l1t_mfn = l2e_get_mfn(*pl2e);
+            l1t = map_xen_pagetable_new(l1t_mfn);
             for ( i = 0; i < L1_PAGETABLE_ENTRIES; i++ )
                 if ( l1e_get_intpte(l1t[i]) != 0 )
                     break;
+            UNMAP_XEN_PAGETABLE_NEW(l1t);
             if ( i == L1_PAGETABLE_ENTRIES )
             {
                 /* Empty: zap the L2E and free the L1 page. */
@@ -5736,7 +5741,7 @@ int modify_xen_mappings(unsigned long s, unsigned long e, unsigned int nf)
                 if ( locking )
                     spin_unlock(&map_pgdir_lock);
                 flush_area(NULL, FLUSH_TLB_GLOBAL); /* flush before free */
-                free_xen_pagetable(l1t);
+                free_xen_pagetable_new(l1t_mfn);
             }
             else if ( locking )
                 spin_unlock(&map_pgdir_lock);
@@ -5767,11 +5772,14 @@ int modify_xen_mappings(unsigned long s, unsigned long e, unsigned int nf)
 
         {
             l2_pgentry_t *l2t;
+            mfn_t l2t_mfn;
 
-            l2t = l3e_to_l2e(*pl3e);
+            l2t_mfn = l3e_get_mfn(*pl3e);
+            l2t = map_xen_pagetable_new(l2t_mfn);
             for ( i = 0; i < L2_PAGETABLE_ENTRIES; i++ )
                 if ( l2e_get_intpte(l2t[i]) != 0 )
                     break;
+            UNMAP_XEN_PAGETABLE_NEW(l2t);
             if ( i == L2_PAGETABLE_ENTRIES )
             {
                 /* Empty: zap the L3E and free the L2 page. */
@@ -5779,12 +5787,13 @@ int modify_xen_mappings(unsigned long s, unsigned long e, unsigned int nf)
                 if ( locking )
                     spin_unlock(&map_pgdir_lock);
                 flush_area(NULL, FLUSH_TLB_GLOBAL); /* flush before free */
-                free_xen_pagetable(l2t);
+                free_xen_pagetable_new(l2t_mfn);
             }
             else if ( locking )
                 spin_unlock(&map_pgdir_lock);
         }
     end_of_loop:
+        UNMAP_XEN_PAGETABLE_NEW(pl2e);
         UNMAP_XEN_PAGETABLE_NEW(pl3e);
     }
 
@@ -5794,6 +5803,7 @@ int modify_xen_mappings(unsigned long s, unsigned long e, unsigned int nf)
     rc = 0;
 
  out:
+    UNMAP_XEN_PAGETABLE_NEW(pl2e);
     UNMAP_XEN_PAGETABLE_NEW(pl3e);
     return rc;
 }
