When shutting down a VM with a stubdomain, a race in cxenstored may cause a double-free.
The xenstored daemon may crash, resulting in a DoS of any parts of the system relying on it (including domain creation / destruction, ballooning, device changes, etc).
All versions of Xen are vulnerable. Only systems running the C version os xenstored ("xenstored") are vulnerable; systems running the Ocaml version ("oxenstored") are not vulnerable. Only systems running devicemodel stubdomains are vulnerable. Only x86 HVM guests can use stubdomains. Therefore ARM systems, x86 systems running only PV guests, and x86 systems running HVM guests with the devicemodel not in a stubdomain (eg in dom0), are not vulnerable.