How to Load & Unload Kernel Extensions in Mac OS X

Kernel extensions, called kext for short, are modules of code that are loaded directly into the kernel space of Mac OS X, able to run at a low-level to perform a variety of tasks. Most kexts are part of the core Mac OS X system software, typically hardware device drivers, but some third party apps will install a kext as well.

Sometimes, advanced Mac users and systems administrators may need to manually load or unload a kernel extension. Because kernel extensions are often critical components of MacOS, this is only appropriate for users who have a specific reason to be modifying whether a kext is loaded or unloaded into the MacOS X kernel space. Inappropriate modification of kext behavior can render Mac hardware useless or inaccessible, and can also prevent Mac OS X from functioning at all, so do not attempt to change any kernel extension without a compelling reason and understanding of what it’s usage is.

Loading a Kernel Extension in Mac OS X with kextload

To load a kernel extension into Mac OS X, you’ll need to use the command line kextload utility. The syntax is otherwise simple enough, requiring sudo for administrative access to perform the action:

sudo kextload /path/to/kext.kext

You can also use the bundle identifier (which are frequently the targets of defaults commands) with the -b flag:

sudo kextload -b com.apple.driver.ExampleBundle

Either way, hit return and with the entry of the administrator password the kernel extension will be loaded into Mac OS X.

You can confirm a kernel has been loaded by listing it with kextstat, using grep to search for the given name like so:

$ kextstat |grep com.apple.driver.ExampleBundle
125 0 0xdddddd7f23351040 0x5000 0x5000 com.apple.driver.ExampleBundle (1) 12 8 7 5 4 2 1

This can be helpful after manually installing a kernel extension into Mac OS X as in some situations it will prevent the need for rebooting the Mac.

Modern versions of Mac OS X also allow kernel extension loading to be completed with the kextutil command, which is a bit more full featured for debugging reasons, but is otherwise the same for loading a kext.

Unloading a Kernel Extension with kextunload

Unloading a kernel extension from Mac OS X is basically the exact same as loading a kext, except you’ll use the kextunload utility with sudo as follows:

sudo kextunload -b com.apple.driver.ExampleBundle

Or by pointing directly to the kernel extensions path:

sudo kextunload /System/Library/Extensions/ThirdPartyMystery.kext

Again, you can confirm the kernel extension has been unloaded by using kextstat and grep, where it should return nothing.