diff --git a/pkg/sentry/mm/pma.go b/pkg/sentry/mm/pma.go
index ef15e704d..468e11932 100644
--- a/pkg/sentry/mm/pma.go
+++ b/pkg/sentry/mm/pma.go
@@ -626,7 +626,27 @@ func (mm *MemoryManager) invalidateLocked(ar hostarch.AddrRange, invalidatePriva
 				// Unmap all of ar, not just pseg.Range(), to minimize host
 				// syscalls. AddressSpace mappings must be removed before
 				// mm.decPrivateRef().
-				mm.unmapASLocked(ar)
+				//
+				// Note that we do more than just ar here, and extrapolate
+				// to the end of any previous region that we may have mapped.
+				// This is done to ensure that lower layers can fully invalidate
+				// intermediate pagetable pages during the unmap.
+				var unmapAR hostarch.AddrRange
+				if prev := pseg.PrevSegment(); prev.Ok() {
+					unmapAR.Start = prev.End()
+				} else {
+					unmapAR.Start = mm.layout.MinAddr
+				}
+				if last := mm.pmas.LowerBoundSegment(ar.End); last.Ok() {
+					if last.Start() < ar.End {
+						unmapAR.End = ar.End
+					} else {
+						unmapAR.End = last.Start()
+					}
+				} else {
+					unmapAR.End = mm.layout.MaxAddr
+				}
+				mm.unmapASLocked(unmapAR)
 				didUnmapAS = true
 			}
 			if pma.private {