I'm perhaps being naive here, but I'm not sure "a simple patch" exists. It could be one of those bugs that requires something non-simple. But I of course have no idea, not having access to the code (nor really even understand the flaw).