What is a Kernel Extension?
The kernel is the absolute core of the macOS operating system. It manages memory, handles CPU scheduling, and dictates how software interacts with the physical hardware. Because the kernel operates at the lowest possible level of the system, Apple heavily restricts what software is allowed to touch it.
However, certain highly specialized applications—such as virtual machines (like Parallels or VMware), advanced antivirus scanners, and niche hardware drivers (like a custom audio interface)—need deeper access than a standard application is permitted to have. To achieve this, these developers write Kernel Extensions, commonly referred to as kexts.
A poorly coded kernel extension can cause catastrophic system instability, resulting in kernel panics (the macOS equivalent of the Blue Screen of Death). If your Mac is mysteriously crashing and you suspect a third-party app is to blame, the kextstat command is the diagnostic tool you need.
Step 1: Open the Terminal
The kextstat command simply lists the kernel extensions that are currently loaded into active RAM. Because it is a purely diagnostic command that only reads data, you do not need sudo privileges to run it.
- Press Command + Space to open Spotlight Search.
- Type
Terminaland press Enter.
Step 2: List All Loaded Kernel Extensions
To dump a list of every single extension currently interacting with the macOS kernel, run:
kextstat
The output will be a massive, highly technical list containing over 150 entries. You will see columns for the Index, References, Address, Size, Wired memory, and the bundle Name (e.g., com.apple.driver.AppleUSBXHCI).
Step 3: Filtering Out Apple’s Official Kexts
The vast majority of the items in that massive list are official, native Apple drivers required to run your Mac (such as the Bluetooth driver, the APFS file system driver, and the trackpad driver). You should never attempt to interfere with these.
If you are troubleshooting a crash, you only care about third-party kernel extensions installed by software you downloaded.
You can filter the list to hide all official Apple extensions by combining kextstat with the grep command (using the -v flag to invert the search):
kextstat | grep -v com.apple
Now, the output will be significantly smaller. You will only see the extensions loaded by third-party developers.
For example, if you see com.intel.kext.intelhaxm, that belongs to the Android Studio emulator. If you see com.paragon-software.filesystems.ntfs, that belongs to a utility that lets your Mac read Windows hard drives. If you do not recognize the developer bundle name on this list, you may have found the source of your kernel panics.
A Note on macOS System Extensions
It is important to understand that Apple is aggressively phasing out traditional Kernel Extensions (kexts) because they are a security and stability risk. In modern versions of macOS, developers are forced to use System Extensions instead, which run entirely in “user space” rather than kernel space. This means if a System Extension crashes, only the extension crashes, not the entire Mac.
Therefore, if you run the kextstat | grep -v com.apple command on a brand-new Mac running macOS Sonoma, the list might be completely empty. This is a good thing! It means all your software is using the modern, safe System Extension architecture instead of the legacy kext architecture.