The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.
https://lists.debian.org/debian-lts-announce/2018/09/msg00006.html