For example, if $M = M_1 || M_2 || \ldots || M_n$, compute
$\operatorname{CMAC}(\operatorname{CMAC}(M_1) || \operatorname{CMAC}(M_2) || \ldots || \operatorname{CMAC}(M_n))$
If we assume that the attacker cannot find two distinct messages $M_1, M_2$ with $\operatorname{CMAC}(M_1) =\operatorname{CMAC}(M_2)$ (which he is unlikely to if the number of messages being MAC'ed is considerably below $2^{64}$), then you're good.
That is, if the attacker is able to produce a message/MAC pair that validates with this construct, then either:
He is able to construct a message/MAC pair for CMAC which we hasn't previously observed; that is $CMAC( M' )$, where $M' = \operatorname{CMAC}(M_1) || \operatorname{CMAC}(M_2) || ... || \operatorname{CMAC}(M_n)$ which he has not previously observed, or
He finds a collision $\operatorname{CMAC}(M_i) = \operatorname{CMAC}(M'_i)$ (and reuses a top-level CMAC he has observed)
(Note that this initial analysis does not consider the possibility of an interaction between the bottom-level and top-level CMAC's, where the attack has actually observed the message $M'$ in one of the bottom level MACs; a full proof would need to address that)
Would it be better to use a XOR operation instead?
$\operatorname{CMAC}(\operatorname{CMAC}(M_1) \oplus \operatorname{CMAC}(M_2) \oplus \ldots \oplus \operatorname{CMAC}(M_n))$
That's far worse; consider the MAC of the message $M_2 || M_1 || M_3 || M_4 || ... || M_n$
