Xen 4.6.3-3 packages, with XSA-190, are currently making their way through the build system. The vulnerability is an intra-guest information leak (i.e., between different processes in the same VM).

More information here:

https://xenbits.xen.org/xsa/advisory-190.html

-George