The vulnerability occurs when torch.load is called with weights_only=True on a specially crafted legacy .tar model file.

1. torch.load is the user-facing API and the entry point for the vulnerability. It dispatches the loading process.
2. For legacy .tar files, torch.load calls the internal function torch.serialization._legacy_load.
3. The core of the vulnerability lay within _legacy_load (specifically, its persistent_load helper function that handles tar files). When weights_only=True was set, the pickle_module used was _weights_only_unpickler. However, _legacy_load did not adequately ensure that this unpickler could safely process all contents of a legacy .tar file under weights_only constraints.
4. The patch introduces an explicit check within _legacy_load (in persistent_load) to raise an error if an attempt is made to load a legacy .tar file with weights_only=True, thereby mitigating the RCE. This confirms that _legacy_load was the function performing the unsafe deserialization under these conditions. Both torch.load (as the entry point) and torch.serialization._legacy_load (as the function containing the flawed deserialization logic for this specific case) are identified as vulnerable.