Xen in the Linux kernel, when running a guest on a host without hardware assisted paging (HAP), allows guest users to cause a denial of service (invalid pointer dereference and hypervisor crash) via the SAHF instruction.
http://rhn.redhat.com/errata/RHSA-2011-1212.html
https://bugzilla.redhat.com/show_bug.cgi?id=718882