Xen in the Linux kernel, when running a guest on a host without hardware assisted paging (HAP), allows guest users to cause a denial of service (invalid pointer dereference and hypervisor crash) via the SAHF instruction.
http://rhn.redhat.com/errata/RHSA-2011-1212.html
http://www.openwall.com/lists/oss-security/2011/08/30/1