The problem could be triggered with a specially crafted hypercall XENMEM_add_to_physmap{, _batch} followed by an access to an address (via hypercall or direct access) that passes the sanity check but cause p2m_get_root_pointer() to return NULL.

Upstream advisory and patch:

http://xenbits.xen.org/xsa/advisory-301.html