This issue should be fixed by commit 49c2c3f246e2 ("cdc_ncm: avoid padding beyond end of skb")
which has been backported to v4.17.3, v4.16.18 and v4.14.52. Please check again with one of those kernel versions (or newer). I see now that the fix doesn't apply cleanly to v4.9 stable due to unrelated context changes. I'll go fix that and resubmit a backport for v4.9, so we get the fix into "stretch" too. Thanks for reminding me. Bjørn