Key Points
- Kernel extensions (KEXTs) operate inside the OS kernel, enhancing software monitoring and management capabilities through deep system integration.
- Since KEXT operates with full kernel privileges, bugs, conflicts, or malicious code can lead to system crashes, data loss, or security controls bypasses.
- Starting with macOS 10.15.4 Catalina, Apple introduced system extensions as a safer alternative to kernel extensions, and by Big Sur, macOS stopped loading kexts that rely on deprecated kernel APIs by default.
- System extensions use DriverKit, Network Extension, and Endpoint Security frameworks to deliver kernel-level capabilities without the associated risk.
- Running extensions in user space limits privilege scope, improves system stability, and aligns with modern macOS security features.
- KEXT usage is increasingly restricted on Apple silicon devices, and Apple has not announced a firm end date for kernel extension support, though system extensions remain the preferred, future-proof approach..
macOS kernel extensions (KEXTs) allow applications to interact with low-level hardware or services, offering deeper functionality, including monitoring and controlling deep system behavior. However, KEXTs run inside the OS kernel with broad privileges, which can introduce security and stability risks.
Apple has been shifting towards system extensions that operate outside the kernel, offering users safer ways to extend platform functionality without compromising security. This shift continues on the current macOS 26 Tahoe release, though Apple has not set a public end date for kernel extension support.
What are macOS kernel extensions?
KEXTs are modules of code that allow apps and platforms to load directly into the macOS kernel, expanding their capabilities. They help with tasks that require direct, system-wide access, such as the following:
- Driver communication: Ensures the OS understands how to use connected devices that it doesn’t handle natively, helping ensure functionality.
- Network stack interactions: KEXTs inspect, filter, redirect, or modify network data, helping network controls like VPN clients and firewalls enforce security policies.
- Low-level system functions: Supplies platforms with deep-level OS metrics, including memory behavior and real-time process activity, suitable for performance tools, security monitoring, and system management utilities.
Simply put, KEXTs provide deep visibility and control over macOS areas where standard applications can’t reach. They enable the OS to communicate with unsupported hardware effectively, allow technicians to observe and control network data, and provide low-level insights into key device metrics.
Associated risks with macOS KEXT usage
The kernel is responsible for managing hardware, memory, and critical OS processes, which makes operating at this level risky. Kernel extensions allow apps, platforms, or services to operate with the same level of trust and authority as the OS itself.
Since these extensions run at the heart of the operating system, they don’t have many safety rails, which can lead to unexpected crashes, bypassed protections, and difficult troubleshooting procedures.
System-wide impact
If a kernel extension contains an error, the consequences are more severe than a bug in standard applications. KEXTs allow code to run in the kernel, which means a single flaw can cause system crashes, instability, and unpredictable device behavior.
In most cases, the system cannot isolate or recover from kernel failures, which can force a reboot and lead to data loss or file system corruption. That said, when a kernel extension breaks, it doesn’t just break an app; it can also break the entire OS.
Potential bypassing of security controls
Malicious KEXTs operate at the OS layer, enabling them to bypass built-in security controls, hide their activity, or tamper with system processes. Due to their kernel-level access, misbehaving KEXTs are challenging to detect and remediate, allowing them to operate silently behind safeguards indefinitely.
Troubleshooting complexity
Managed macOS devices usually run multiple kernel extensions to support device management and monitoring tools. When these extensions conflict with each other, or with macOS updates, the outcome can be hard to trace. This leads to extensive and time-consuming diagnostic procedures that require deep system knowledge to pull off effectively.
| Risk | Mitigation |
| System-wide impact | Test and stage KEXTs before broad deployment, and monitor for crash patterns after macOS updates. |
| Bypassed security controls | Restrict KEXT approval to vetted vendors and enforce approval through MDM rather than user discretion. |
| Troubleshooting complexity | Use MDM-driven approval logs to trace which extension was loaded, when, and on which devices. |
macOS system extensions: A modern alternative to KEXTs
Although kernel extensions pose risks to devices and managed environments, their use is undeniably essential to a proactive IT management strategy. To address the potential risks associated with KEXTs, Apple introduced Mac system extensions, a safer alternative for deep OS software integration.
System extensions are delivered through dedicated system frameworks that operate within user spaces:
- DriverKit: Supports hardware drivers without requiring kernel access.
- Network extensions: User-space components that allow apps to extend their native networking capabilities.
- Endpoint security extensions: Offers system-level visibility for modern security tools, like Endpoint Detection and Response (EDR) and VPN tools.
- FSKit: Lets developers build custom file systems in user space instead of as kernel extensions, extending the same shift away from kernel-level code to storage and file-system drivers.
Shifting these integrations outside the kernel enables IT teams and MSPs to preserve their management and monitoring capabilities without the systemic risks that come with KEXTs. Apple achieves this by changing where extensions run, how much access is granted, and how failures are contained.
User-space operation
Unlike KEXTs, system extensions operate outside the macOS kernel, preventing third-party code from running below the OS layer. If a system extension fails or misbehaves, macOS can isolate the problem without crashing the system, improving overall reliability.
Limited privilege scope
System extensions maintain least-privilege access by performing only approved actions. For instance, a networking extension can observe or manage network traffic without gaining access to unrelated system components or metrics. This scoped access reduces your environment’s attack surface and limits the blast radius caused by bugs or malicious code.
Improved stability and security
System extensions integrate cleanly with macOS security features, including System Integrity Protection, code signing, and user or MDM-based approvals. Additionally, macOS updates are less likely to break them, and failures are easier to troubleshoot and remediate.
Management strategy for macOS kernel extensions
Although Apple is continually moving toward incorporating system extensions, macOS still supports KEXTs, especially in legacy scenarios. Specifically, this exists to support older software and specialized tools that haven’t transitioned to using system extensions.
KEXTs require explicit control and approval through the following:
- User approval: macOS requires users to manually approve KEXT usage before it takes effect, creating an intentional friction point. On Macs running macOS Sequoia or the current macOS Tahoe release, this approval appears under System Settings> General> Login Items & Extensions; earlier macOS versions use the Privacy & Security pane instead.
- MDM-driven approval: Some macOS MDMs allow centralized KEXT approval and whitelisting to speed up load times without requiring user-initiated actions.
- Trust-based approval: Allows administrators to approve KEXTs from a known vendor family to simplify kernel extension management; however, it requires careful vendor vetting.
Additionally, administrators can leverage MDMs to prevent users from approving kernel extensions independently. This control ensures that KEXT governance rests with administrators through policies, preventing users from unknowingly authorizing unsafe extensions.
Impact of Apple silicon and modern macOS architecture
At WWDC 2019, Apple formally announced the deprecation of KEXTs and introduced system extensions in macOS 10.15.4 Catalina as their replacement. In the subsequent year, Apple also announced Apple silicon, which changed how macOS handles trust, security, and low-level system access.
On modern Apple silicon and macOS devices, kernel extensions won’t load unless explicitly allowed, directly conflicting with modern macOS security design. For managed environments, this increases friction and risk when leveraging KEXT at scale.
These strict KEXT restrictions are intentional, as kernel-level extensions can harm devices by introducing external, sometimes unapproved, code into the OS. For IT teams and MSPs managing legacy environments, KEXT dependency will increasingly require security exceptions, manual intervention, or architectural compromises.
As of 2026, Apple has not confirmed a macOS version in which kernel extensions will stop functioning altogether, and current guidance indicates support is expected to continue into macOS 27, though the pattern of tightening restrictions is likely to continue with each release.
Manage macOS system or kernel extensions with NinjaOne
NinjaOne MDM offers several features that help administrators manage kernel and security extensions centrally and at scale across macOS environments.
- System extensions management: Add or block specific system extensions through the NinjaOne agent policy, and use bundle identifiers to streamline system extension approvals from trusted vendors.
- Privacy preferences management: Pre-configure privacy permissions for specific managed applications, granting necessary access to data sources without requiring user interaction.
- Policy assignment and enforcement: Configure MDM settings, including system extensions, within macOS agent policies. View and manage overridden sections of assigned policies via the device dashboard.
- Device actions: Speed up administrative workflows by using device actions, such as shutting down, installing the NinjaOne agent, or deleting MDM-enrolled macOS devices, directly from the NinjaOne console.
Quick-Start Guide
NinjaOne can help manage macOS Kernel Extensions (KEXTs) and System Extensions through its MDM capabilities. Here’s how NinjaOne supports macOS extension management:
System Extensions Management
- Add or Block System Extensions: Administrators can add or block specific system extensions using bundle identifiers, streamlining approvals for trusted vendors.
- Privacy Preferences Management: Pre-configure privacy permissions for managed applications to grant necessary access without requiring user interaction.
Policy Assignment and Enforcement
- MDM Settings in Agent Policies: Configure MDM settings, including system extensions, within macOS agent policies.
- View Policy Overrides: Manage overridden sections of assigned policies via the device dashboard for better control and visibility.
Device Actions
- Administrative Workflows: Use device actions such as shutting down, installing the NinjaOne agent, or deleting MDM-enrolled macOS devices directly from the NinjaOne console to speed up administrative tasks.
Centralized Control
- User Approval Management: Require user approval for KEXTs or use MDM-driven approval to centrally manage and whitelist extensions.
- Trust-Based Approval: Allow administrators to approve KEXTs from known vendors, simplifying management while maintaining security.
Compatibility with Apple Silicon: NinjaOne helps manage the increased restrictions on KEXTs for Apple Silicon devices, ensuring compatibility and reducing risk in modern macOS environments.
Securing macOS kernel and system extension usage
Kernel extensions play a key role in expanding software and platform capabilities; however, deep kernel access poses security and stability challenges for environments. Apple’s shift towards the use of system extensions helps mitigate risks that come with KEXT usage, while improving device reliability.
Clearly understanding the transition between kernel and system extensions helps you manage macOS devices more securely. Additionally, this helps you plan for future upgrades, ensuring compatibility and streamlining workflows for managed legacy macOS environments.
Related topics:
