How to Inspect, Load, and Manage Kernel Extensions in macOS Using kmutil in Terminal

The Evolution of Kernel Management in Modern macOS

In historical releases of Apple’s desktop operating system, hardware drivers, low-level virtual network adapters, and deep system monitors relied on Kernel Extensions (commonly referred to as kexts). These binary bundles ran directly inside Ring 0 (the XNU kernel space). To manage, load, and debug these modules, administrators and developers used legacy command-line utilities including kextload, kextunload, and kextstat.

Starting with macOS Big Sur, Monterey, Ventura, Sonoma, and Sequoia, Apple re-architected the low-level foundation of macOS to enforce System Integrity Protection (SIP), cryptographically sealed system snapshots (SSV), and Apple Silicon secure boot architectures. While Apple strongly encourages developers to transition towards user-space System Extensions via the EndpointSecurity and DriverKit frameworks, legacy enterprise software (such as enterprise VPNs, hardware hypervisors, and audio interfaces) still requires kext management.

To unify kext administration, Apple deprecated the fragmented kext* tools and introduced kmutil (Kernel Management Utility). kmutil serves as the definitive command-line console to inspect, load, trigger, rebuild, and diagnose kernel collections across modern Mac systems.

Understanding the Auxiliary Kernel Collection (AKC)

On Apple Silicon and modern Intel Macs, the macOS kernel does not load loose, individual .kext bundles directly from disk on the fly. Instead, all approved third-party kernel extensions are compiled into a unified, cryptographically signed memory archive called the Auxiliary Kernel Collection (AKC). The AKC is linked against the primary Boot Kernel Collection (BKC) during the boot sequence.

Whenever you install, update, or remove a third-party kernel extension, kmutil coordinates with the kernelmanagerd daemon to rebuild this unified kernel collection, which is subsequently validated against the Secure Enclave and LocalPolicy settings.

Essential kmutil Subcommands and Command Syntax

The kmutil architecture uses structured subcommands for specific administration duties:

kmutil <subcommand> [options] [arguments]

Subcommand	Functional Capability	Administrative Privilege Required
kmutil show	Lists all currently loaded, active kernel extensions across collections.	Standard User
kmutil load	Requests kernelmanagerd to stage and load a specific kext bundle.	Root / sudo
kmutil unload	Signals the kernel to terminate and unload an active kext.	Root / sudo
kmutil inspect	Audits a kext directory or collection for bundle dependencies and architectures.	Standard User
kmutil trigger-panic-medic	Emergency recovery command that purges all third-party kexts if the Mac bootloops.	Root / Recovery OS
kmutil check	Validates kext signatures, architecture slices, and Mach-O header integrity.	Standard User

How to Inspect Active Kernel Extensions

1. Listing Loaded Kernel Extensions

To inspect every active kernel extension running on your Mac—replacing the legacy kextstat command—run:

kmutil show

Because the default output displays hundreds of native Apple drivers, filter strictly for non-Apple (third-party) extensions using the --show-custom flag:

kmutil show --show-custom

The resulting table displays the index, bundle identifier, version, memory address, and dependency links for each active third-party driver.

2. Filtering by Bundle Identifier

If you are troubleshooting a specific virtualisation or networking driver (such as VMware, VirtualBox, or audio loopback drivers):

kmutil show -b com.intel.driver.example

Loading and Staging Kernel Extensions

To stage a kernel extension for integration into the Auxiliary Kernel Collection:

sudo kmutil load -p /Library/Extensions/VendorDriver.kext

On modern macOS builds, if the kext has not yet been approved by the user, the operating system will return an approval requirement error (System Policy Blocked). The administrator must open System Settings > Privacy & Security, scroll to the Security section, and click Allow next to the blocked developer certificate.

Security Notice on Apple Silicon: On Mac computers powered by Apple Silicon (M1, M2, M3, M4), third-party kernel extensions cannot load under the default “Full Security” boot policy. You must boot into macOS Recovery, launch the Startup Security Utility, and configure the boot drive to Reduced Security with the option “Allow user management of kernel extensions from identified developers” enabled.

Unloading and Removing Third-Party Extensions

To dynamically detach an active kext from the operational kernel:

sudo kmutil unload -b com.vendor.driver.name

To permanently purge an unwanted kernel extension:

1. Delete the physical bundle directory from the extensions repository:

   sudo rm -rf /Library/Extensions/VendorDriver.kext

2. Rebuild the Auxiliary Kernel Collection and clear stale staging caches:

   sudo kmutil clear-staging

3. Restart your Mac to finalise the boot image.

Emergency Recovery: The Panic Medic Command

If an incompatible or corrupted third-party driver triggers a continuous Kernel Panic upon startup (preventing you from reaching the login window):

1. Boot into macOS Recovery (hold down the Power button on Apple Silicon until “Loading startup options” appears, or press Command + R on Intel Macs).
2. From the menu bar at the top of the screen, select Utilities > Terminal.
3. Execute the built-in emergency recovery protocol:

   kmutil trigger-panic-medic

4. Restart your Mac. The operating system will bypass and quarantine all non-Apple kernel extensions, allowing you to boot cleanly into macOS to uninstall the problematic software.