xen-kernel -- x86 PV guests may be able to mask interrupts

The Xen Project reports:

Certain PV guest kernel operations (page table writes in
particular) need emulation, and use Xen’s general x86 instruction
emulator. This allows a malicious guest kernel which asynchronously
modifies its instruction stream to effect the clearing of EFLAGS.IF
from the state used to return to guest context.
A malicious guest kernel administrator can cause a host hang or
crash, resulting in a Denial of Service.