The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.
Exploitability
AV:LAC:LAu:NImpact
C:NI:NA:C4.9/AV:L/AC:L/Au:N/C:N/I:N/A:C