More information about this security flaw is available in the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=2360999 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The fixing commit is https://github.com/pytorch/pytorch/commit/8d4b8a920a2172523deb95bf20e8e52d50649c04
The issue is that even when using the safe configuration of weights_only=True in torch.load, if a file in the legacy tar format is provided, the load process continues unsafely since legacy tar files can only be loaded unsafely. Oops. The fixing commit adds a check to prevent this from happening. The fix is present in 2.6.0 and newer, so only Fedora 42 is both currently maintained and impacted.
Proposed fix is in https://src.fedoraproject.org/rpms/python-torch/pull-request/8