{
	"id": "c99689fe-8d8a-456d-8842-5a66f33556d3",
	"created_at": "2026-04-06T01:30:52.098229Z",
	"updated_at": "2026-04-10T13:13:08.495793Z",
	"deleted_at": null,
	"sha1_hash": "1db85422498652952d7ed9bf16983a68b4ae8d57",
	"title": "Deprecated Kernel Extensions and System Extension Alternatives - Support",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 53116,
	"plain_text": "Deprecated Kernel Extensions and System Extension Alternatives -\r\nSupport\r\nBy Apple Inc.\r\nArchived: 2026-04-06 00:38:39 UTC\r\nSystem extensions on macOS Catalina 10.15 or later allow software, such as network extensions and endpoint\r\nsecurity solutions, to extend the functionality of macOS without requiring kernel-level access. As part of our\r\nongoing effort to modernize the platform, improve security and reliability, and enable more user-friendly\r\ndistribution methods, kernel extensions have been deprecated. Starting with macOS Big Sur, macOS releases no\r\nlonger load kernel extensions that use deprecated kernel programming interfaces (KPIs) by default.\r\nTransitioning your kernel extensions\r\nCertain kernel extensions are unsupported on macOS Big Sur. If your software uses deprecated and supported\r\nKPIs for older versions of macOS, you’ll need to factor out deprecated components into a stand-alone system\r\nextension. If your software uses new system extensions and legacy kernel extensions, you can distribute to\r\nsupported operating systems. Software that supports a broad range of macOS versions should continue to use\r\nkernel extensions for older versions and run system extensions where supported.\r\nBelow is a list of unsupported KPIs as of macOS Big Sur. Any kernel extension using an unsupported KPI will not\r\nload.*\r\nKAUTH\r\nUnsupported: macOS Big Sur 11.0\r\nDeprecated: macOS Catalina 10.15\r\nThe following KPIs are unsupported in macOS Big Sur. Clients should use EndpointSecurity instead.\r\nkauth_listen_scope\r\nkauth_unlisten_scope\r\nSocket\r\nDeprecated: macOS Catalina 10.15\r\nThe following Socket KPIs continue to be deprecated in macOS Big Sur. Clients should use NetworkExtension\r\ninstead.\r\nsock_accept\r\nsock_bind\r\nsock_close\r\nhttps://developer.apple.com/support/kernel-extensions/\r\nPage 1 of 4\n\nsock_connect\r\nsock_getpeername\r\nsock_getsockname\r\nsock_getsockopt\r\nsock_gettype\r\nsock_ioctl\r\nsock_isconnected\r\nsock_isnonblocking\r\nsock_listen\r\nsock_receive\r\nsock_receivembuf\r\nsock_release\r\nsock_retain\r\nsock_send\r\nsock_sendmbuf\r\nsock_setsockopt\r\nsock_shutdown\r\nsock_socket\r\nNetwork filter\r\nUnsupported: macOS Big Sur 11.0\r\nDeprecated: macOS Catalina 10.15\r\nThe following Network Filter KPIs are unsupported in macOS Big Sur:\r\nipf_addv4\r\nipf_addv6\r\nipf_inject_input\r\nipf_inject_output\r\nipf_remove\r\nsflt_attach\r\nsflt_detach\r\nsflt_register\r\nsflt_unregister\r\nsock_inject_data_in\r\nsock_inject_data_out\r\nsock_setpriv\r\nsockopt_copyin\r\nsockopt_copyout\r\nsockopt_direction\r\nsockopt_level\r\nsockopt_name\r\nsockopt_valsize\r\nhttps://developer.apple.com/support/kernel-extensions/\r\nPage 2 of 4\n\nIOHIDFamily\r\nUnsupported: macOS Big Sur 11.0\r\nDeprecated: macOS Catalina 10.15\r\nAll KPIs in IOHIDFamily are unsupported in macOS Big Sur. Clients should use HIDDriverKit instead.\r\nIOUSBFamily\r\nUnsupported: macOS Big Sur 11.0\r\nDeprecated: OS X El Capitan 10.11\r\nAll KPIs in IOUSBFamily are unsupported in macOS Big Sur. Clients should move to IOUSBHostFamily or\r\nUSBDriverKit, where appropriate and as outlined below.\r\nUSB networking\r\nUnsupported: macOS Big Sur 11.0\r\nDeprecated: macOS Catalina 10.15\r\nThe combination of using IONetworkingFamily KPIs as well as any USB KPI (IOUSBHostFamily or\r\nIOUSBFamily) is unsupported in macOS Big Sur. USB KPIs have alternatives in USBDriverKit. Clients of\r\nIONetworkingFamily KPIs should use NetworkingDriverKit instead.\r\nUSB serial\r\nUnsupported: macOS Big Sur 11.0\r\nDeprecated: macOS Catalina 10.15\r\nThe combination of using any IOSerialFamily KPI as well as any USB KPI (IOUSBHostFamily or\r\nIOUSBFamily) is unsupported in macOS Big Sur. USB KPIs have alternatives in USBDriverKit. Clients of\r\nIOSerialFamily KPIs should use SerialDriverKit or USBSerialDriverKit instead.\r\nUSB vendor-specific IPC\r\nUnsupported: macOS Big Sur 11.0\r\nDeprecated: macOS Catalina 10.15\r\nAny kernel extension using USB KPI (IOUSBHostFamily or IOUSBFamily) that doesn't tie into the IO Family\r\nsubsystem and uses IOUserClient, or subclasses, for IPC is unsupported in macOS Big Sur. USB KPIs have\r\nalternatives in USBDriverKit or consider IOUSBHost framework. DriverKit also has mechanisms for\r\ncommunication channels.\r\nPCI networking\r\nhttps://developer.apple.com/support/kernel-extensions/\r\nPage 3 of 4\n\nUnsupported: macOS Big Sur 11.0\r\nDeprecated: macOS Catalina 10.15\r\nThe combination of using IONetworkingFamily KPIs as well as IOPCIFamily KPIs is deprecated. PCI KPIs have\r\nalternatives in PCIDriverKit. Clients of IONetworkingFamily KPIs should use NetworkingDriverKit instead.\r\nIOAudioFamily\r\nDeprecated: macOS Monterey 12.3\r\nAll KPIs in IOAudioFamily are deprecated in macOS Monterey 12.3. Clients should use AudioDriverKit instead.\r\nIOBluetoothHIDDriver\r\nDeprecated: macOS Monterey 12.3\r\nAll KPIs in IOBluetoothHIDDriver are deprecated in macOS Monterey 12.3. Bluetooth LE clients should use\r\nCoreBluetooth instead. Bluetooth \"Classic\" is no longer supported.\r\nIOSCSIParallelFamily\r\nDeprecated: macOS Monterey 12.3\r\nAll KPIs in IOSCSIParallelFamily are deprecated in macOS Monterey 12.3. Clients should use\r\nSCISControllerDriverKit instead.\r\nContacting us\r\nEntitlements\r\nTo deploy drivers built with DriverKit or use the EndpointSecurity API, you’ll need an entitlement from Apple.\r\nRequest an entitlement\r\nFeedback\r\nYour feedback is valuable and helps inform the direction of our system extension development. Send us your API\r\nenhancement requests or bug reports through Feedback Assistant.\r\nProvide feedback\r\nSource: https://developer.apple.com/support/kernel-extensions/\r\nhttps://developer.apple.com/support/kernel-extensions/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://developer.apple.com/support/kernel-extensions/"
	],
	"report_names": [
		"kernel-extensions"
	],
	"threat_actors": [],
	"ts_created_at": 1775439052,
	"ts_updated_at": 1775826788,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/1db85422498652952d7ed9bf16983a68b4ae8d57.pdf",
		"text": "https://archive.orkl.eu/1db85422498652952d7ed9bf16983a68b4ae8d57.txt",
		"img": "https://archive.orkl.eu/1db85422498652952d7ed9bf16983a68b4ae8d57.jpg"
	}
}