I'm perhaps being naive here, but I'm not sure "a simple patch" exists.  It could be one of those bugs that requires something non-simple.  But I of course have no idea, not having access to the code (nor really even understand the flaw).