);
 
        kvm_cpu_cap_mask(CPUID_7_ECX,
-               F(AVX512VBMI) | F(LA57) | 0 /*PKU*/ | 0 /*OSPKE*/ | F(RDPID) |
+               F(AVX512VBMI) | F(LA57) | F(PKU) | 0 /*OSPKE*/ | F(RDPID) |
                F(AVX512_VPOPCNTDQ) | F(UMIP) | F(AVX512_VBMI2) | F(GFNI) |
                F(VAES) | F(VPCLMULQDQ) | F(AVX512_VNNI) | F(AVX512_BITALG) |
                F(CLDEMOTE) | F(MOVDIRI) | F(MOVDIR64B) | 0 /*WAITPKG*/
        if (cpuid_ecx(7) & F(LA57))
                kvm_cpu_cap_set(X86_FEATURE_LA57);
 
+       /*
+        * PKU not yet implemented for shadow paging and requires OSPKE
+        * to be set on the host. Clear it if that is not the case
+        */
+       if (!tdp_enabled || !boot_cpu_has(X86_FEATURE_OSPKE))
+               kvm_cpu_cap_clear(X86_FEATURE_PKU);
+
        kvm_cpu_cap_mask(CPUID_7_EDX,
                F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) |
                F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES) | F(INTEL_STIBP) |
 
        if (vmx_pt_mode_is_host_guest())
                kvm_cpu_cap_check_and_set(X86_FEATURE_INTEL_PT);
 
-       /* PKU is not yet implemented for shadow paging. */
-       if (enable_ept && boot_cpu_has(X86_FEATURE_OSPKE))
-               kvm_cpu_cap_check_and_set(X86_FEATURE_PKU);
-
        if (vmx_umip_emulated())
                kvm_cpu_cap_set(X86_FEATURE_UMIP);