Unfortunately I don’t have any better ideas.
Xen might be the issue, but I’d kind of expect to see the same behavior across users in that case. The only other mechanism that I can think of that would have user-based access restrictions would be something like SELinux. It might be worth double checking. It looks like it is enabled by default on the CentOS VM I brought up.