The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.
https://xenbits.xenproject.org/xsa/advisory-504.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49784