diff --git a/repos/ports/ports/seoul.hash b/repos/ports/ports/seoul.hash
index 2d22377d9c..f34dc03b63 100644
--- a/repos/ports/ports/seoul.hash
+++ b/repos/ports/ports/seoul.hash
@@ -1 +1 @@
-8e3190c4e76643db3dfb18ea84597ba1bbd2c218
+06deb9c426754ba1ba028e056bcd33a1b47d2d0b
diff --git a/repos/ports/ports/seoul.port b/repos/ports/ports/seoul.port
index 55abd48e99..2d960413c1 100644
--- a/repos/ports/ports/seoul.port
+++ b/repos/ports/ports/seoul.port
@@ -3,8 +3,8 @@ VERSION   := git
 DOWNLOADS := seoul.git
 
 URL(seoul) := https://github.com/alex-ab/seoul.git
-# branch pae - containing smp and vbios patches
-REV(seoul) := 4c82009d2da7b771c6402d7cdaf3f65cdc6fde62
+# branch genode_15_08 - containing smp and vbios patches
+REV(seoul) := 5522d06563fa09a532e0e69e845866bd21605fa2
 DIR(seoul) := src/app/seoul
 
 #
diff --git a/repos/ports/src/app/seoul/main.cc b/repos/ports/src/app/seoul/main.cc
index 3a7beed639..19116a82c3 100644
--- a/repos/ports/src/app/seoul/main.cc
+++ b/repos/ports/src/app/seoul/main.cc
@@ -663,6 +663,23 @@ class Vcpu_dispatcher : public Vcpu_handler,
 			_handle_vcpu(SKIP, CpuMessage::TYPE_WRMSR);
 		}
 
+		/*
+		 * This VM exit is in part handled by the NOVA kernel (writing the CR
+		 * register) and in part by Seoul (updating the PDPTE registers,
+		 * which requires access to the guest physical memory).
+		 * Intel manual sections 4.4.1 of Vol. 3A and 26.3.2.4 of Vol. 3C
+		 * indicate the conditions when the PDPTE registers need to get
+		 * updated.
+		 *
+		 * XXX: not implemented yet
+		 *
+		 */
+		void _vmx_mov_crx()
+		{
+			Logging::panic("%s: not implemented, but needed for VMs using PAE "
+			               "with nested paging.", __PRETTY_FUNCTION__);
+		}
+
 		/**
 		 * Shortcut for calling 'Vmm::Vcpu_dispatcher::register_handler'
 		 * with 'Vcpu_dispatcher' as template argument
@@ -747,6 +764,8 @@ class Vcpu_dispatcher : public Vcpu_handler,
 					(exc_base, MTD_RIP_LEN | MTD_GPR_ACDB | MTD_TSC | MTD_STATE);
 				_register_handler<18, &This::_vmx_vmcall>
 					(exc_base, MTD_RIP_LEN | MTD_GPR_ACDB);
+				_register_handler<28, &This::_vmx_mov_crx>
+					(exc_base, MTD_ALL);
 				_register_handler<30, &This::_vmx_ioio>
 					(exc_base, MTD_RIP_LEN | MTD_QUAL | MTD_GPR_ACDB | MTD_STATE | MTD_RFLAGS);
 				_register_handler<31, &This::_vmx_msr_read>