How to Use the ‘kextstat’ Command to Audit Kernel Extensions

The Danger of Kernel Extensions

Modern operating systems are incredibly secure, largely because applications are forced to run in “User Space.” If a User Space application crashes or gets infected with malware, it is strictly isolated and cannot harm the underlying operating system.

However, certain highly specialized applications-like enterprise VPN clients, audio mixing software, and legacy antivirus agents-require direct, unrestricted access to the computer’s hardware. To achieve this, developers write Kernel Extensions (.kext).

When a Kernel Extension is loaded, it is injected directly into the macOS Kernel (the core of the operating system). It bypasses all User Space protections. If a poorly written `.kext` crashes, the entire Mac suffers an immediate, unrecoverable “Kernel Panic” (the macOS equivalent of the Blue Screen of Death).

If a Mac is constantly crashing, an IT administrator must audit exactly what third-party code has been injected into the kernel. To do this, they use the kextstat (Kernel Extension Statistics) command.

1. Auditing the Kernel

Open the macOS Terminal and simply run:

kextstat

Your screen will flood with a massive table of currently loaded extensions. You will see columns for memory mapping, the extension’s version number, and the bundle identifier (e.g., com.apple.driver.AppleSMC).

Because there are hundreds of native Apple extensions required to run the Mac, reading this raw output is overwhelming.

2. Filtering Out Native Apple Code

If you are troubleshooting a crash, you can safely ignore Apple’s native extensions. The problem is almost always caused by third-party software.

To filter the list and only show third-party Kernel Extensions, you can pipe the output into the grep command and exclude anything signed by Apple:

kextstat | grep -v com.apple

Breaking down the flags:

• -v (Invert Match): Tells grep to exclude any line containing the string com.apple.

The output will drastically shrink. You will likely see exactly what is causing the instability-perhaps an outdated Wacom tablet driver (com.wacom.kext.wacomtablet) or a rogue networking filter.

3. The Transition to System Extensions

It is critical to note that Apple despises Kernel Extensions due to their inherent security risks. Starting with macOS Catalina and heavily enforced in macOS Big Sur, Apple began aggressively deprecating .kext files.

Apple introduced a modern, infinitely safer alternative called System Extensions. These perform the exact same tasks (like network filtering) but are executed in isolated User Space.

If you need to audit modern System Extensions on an Apple Silicon Mac, you cannot use kextstat. Instead, you must use the modern equivalent:

systemextensionsctl list

This command will explicitly list all active User Space extensions, their developer team IDs, and whether they are currently activated or waiting for user approval in the Privacy & Security settings.

Conclusion

While Apple is actively killing off Kernel Extensions, they still exist in legacy environments and highly specialized hardware workflows. The kextstat command remains the definitive diagnostic tool for identifying rogue, poorly optimized third-party code that is secretly causing kernel-level instability on your fleet of Macs.