Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
It looks like mesa only has a handful of Rust crate dependencies, for NVK. These are vendored *individually* in RHEL, so we can tell what they are: paste, proc-macro2, quote, syn, unicode-dient, and rustc-hash. Obviously, tar is not one of them. Doing a local mock build in Fedora and checking what is installed into the mock chroot verifies this finding: rust-tar is nowhere in the dependency tree for mesa, so this CVE does not apply.