VirtualBox/Installation/Linux

Debian

Debian-based Linux distributions

Add the following line to your /etc/apt/sources.list. For Debian 11 and older, replace '<mydist>' with 'bullseye', 'buster', or 'stretch'. For Ubuntu 22.04 and older, 'replace '<mydist>' with 'jammy', 'eoan', 'bionic', 'xenial',

deb [arch=amd64 signed-by=/usr/share/keyrings/oracle-virtualbox-2016.gpg] https://download.virtualbox.org/virtualbox/debian <mydist> contrib

The Oracle public key for verifying the signatures can be downloaded here. You can add these keys with

sudo gpg --yes --output /usr/share/keyrings/oracle-virtualbox-2016.gpg --dearmor oracle_vbox_2016.asc

or combine downloading and registering:

wget -O- https://www.virtualbox.org/download/oracle_vbox_2016.asc | sudo gpg --yes --output /usr/share/keyrings/oracle-virtualbox-2016.gpg --dearmor

The key fingerprint for oracle_vbox_2016.asc is

B9F8 D658 297A F3EF C18D  5CDF A2F6 83C5 2980 AECF
Oracle Corporation (VirtualBox archive signing key) <info@virtualbox.org>

To install VirtualBox, do

sudo apt-get update
sudo apt-get install virtualbox-7.1

Replace virtualbox-7.1 by virtualbox-7.0 to install the latest VirtualBox 7.0 build.

What to do when experiencing The following signatures were invalid: BADSIG ... when refreshing the packages from the repository?

# sudo -s -H
# apt-get clean
# rm /var/lib/apt/lists/*
# rm /var/lib/apt/lists/partial/*
# apt-get clean
# apt-get update

If you previously added the Oracle key(s) to your default keyring (now considered insecure), remove them again with:

sudo apt-key remove 5CDFA2F683C52980AECF
sudo apt-key remove D9C954422A4B98AB5139

(As of VirtualBox 3.2, the signing key was changed. The old Sun public key for apt-secure can be downloaded ​here. Likewise, the Oracle public key for distributions older than Debian 8 and Ubuntu 16.04 can be downloaded here.)