The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-8492
http://xenbits.xen.org/xsa/advisory-169.html