Xen in the Linux kernel, when running a guest on a host without hardware assisted paging (HAP), allows guest users to cause a denial of service (invalid pointer dereference and hypervisor crash) via the SAHF instruction.
https://bugzilla.redhat.com/show_bug.cgi?id=718882
http://xenbits.xen.org/hg/xen-3.1-testing.hg/rev/15644