How to Use the macOS kextstat Command to View Loaded Kernel Extensions

The Dangers of Kernel Extensions

The core of the macOS operating system is called the kernel. It is heavily protected and completely isolated from standard software. However, certain types of low-level applications—like third-party antivirus software, virtual machines (like VirtualBox), or custom audio interface drivers—require direct access to the computer’s deepest hardware components.

To grant this access, these apps install Kernel Extensions (Kexts). When a Kext is loaded, it runs with absolute privileges. If a third-party Kext contains a bug, it will not just crash the app; it will trigger a catastrophic “Kernel Panic,” instantly freezing your Mac and forcing a hard reboot.

If your Mac is suffering from random crashes or extreme CPU overheating, identifying a rogue third-party Kext is a crucial troubleshooting step. You cannot see these extensions in the standard Activity Monitor. You must use the kextstat command.

Step 1: Open the Terminal

Because you are probing the deepest layers of the operating system, you should use the Terminal.

1. Press Command + Space to open Spotlight Search.
2. Type Terminal and press Enter.

Step 2: Viewing All Loaded Extensions

To see a complete list of every single kernel extension currently loaded into your Mac’s active memory, simply run:

kextstat

The terminal will output a massive, complicated table. The columns are:

• Index: The order in which the extension was loaded.
• Refs: How many other components are actively using it.
• Address: Where it lives in the physical RAM.
• Size: How much memory it consumes.
• Wired: Similar to size, memory locked by the kernel.
• Architecture: (e.g., x86_64 or arm64e).
• Name: The actual bundle identifier of the extension.

Step 3: Filtering Out Apple’s Extensions

When you run the standard kextstat command, you will likely see over 150 items. Almost all of these belong to Apple (e.g., com.apple.driver.AppleGraphicsDeviceControl, com.apple.iokit.IOUSBHostFamily). Apple’s native extensions are highly optimized and are almost never the cause of a system crash.

To troubleshoot a crashing Mac, you only care about the third-party extensions installed by software you downloaded from the internet.

To filter the list and hide all official Apple extensions, use the grep command (with the -v invert flag) to subtract the word “apple” from the results:

kextstat | grep -v com.apple

This command will drastically reduce the list from 150 items down to a handful of items. You might see something like org.virtualbox.kext.VBoxDrv or com.symantec.mes.systemextension.

Step 4: Analyzing the Results

Once you have isolated the non-Apple extensions, you can begin troubleshooting.

If your Mac is randomly crashing, look closely at this filtered list. If you see a kernel extension belonging to a piece of software you uninstalled three years ago, that “zombie” extension might be incompatible with the newest version of macOS, causing the panics.

You can then research the specific bundle identifier online, navigate to /Library/Extensions/ or /System/Library/Extensions/, and use the kextunload command (or physically delete the file in Safe Mode) to safely remove the offending software from your kernel.