Xen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1 non-transitive grant which allows local guest administrators to cause a denial of service (host crash) obtain sensitive information or possibly have other impacts via unspecified vectors.