PHYSDEVOP_get_free_pirq does not check that its call to get_free_pirq succeeded, and if it fails will use the error code as an array index.

A malicious guest might be able to cause the host to crash, leading to a DoS, depending on the exact memory layout.  Privilege escalation is a theoretical possibility which cannot be ruled out, but is considered unlikely

Acknowledgements:

Red Hat would like to thank the Xen project for reporting this issue. Upstream acknowledges Matthew Daley as the original reporter.