Xen 4.4.x when running on an ARM system and \handling an unknown system register access from 64-bit userspace \ returns to an instruction of the trap handler for kernel space faults instead of an instruction that is associated with faults in 64-bit userspace which allows local guest users to cause a denial of service (crash) and possibly gain privileges via a crafted process.