Qubes OS Warns of APT Security Flaw Affecting Whonix and Debian VMs

Qubes OS issued QSB-122 on November 6, 2026, addressing an APT vulnerability that could let an attacker replace verified software packages inside Debian and Whonix qubes. The bulletin specifies an update order and separate fixes for Qubes' update tools.

CVE-2026-109518 concerns software installation, not Monero's cryptography. Wallet users rely on the operating system underneath their wallet to protect its files and run the intended software.

How the APT verification flaw works

APT normally checks downloaded packages against authenticated repository metadata. A valid check should mean the file installed is the file the repository intended to distribute. This vulnerability breaks that connection after verification.

Debian's November 4 advisory, DSA-6607-1, credits researcher Max Justicz. It describes two downloads becoming associated with the same address after a redirect. Faulty handling when a download resumes can then let an attacker replace the package. Installation can execute the substituted package's code with root privileges.

The APT maintainer's disclosure identifies reused hard links, which let two filenames refer to the same underlying file, alongside redirects and retried downloads. Exploitation requires a nonzero Acquire::Retries setting. Retries became the default in APT 2.3.2, although older installations can enable them too. The attacker also needs control over the download server or a way to tamper with its traffic.

Which Debian and Whonix versions need fixes?

The Debian security tracker identifies these affected and fixed package versions:

Debian's security repositories provide both fixes. The tracker also records 3.3.6 for unstable. That is not a recommendation to move a stable system to unstable.

Whonix inherits APT from Debian. Whonix 18 uses the Trixie base, whose APT fix is 3.0.4. In the Whonix developer discussion, arraybolt3 says installations without a fixed APT remain vulnerable. Patrick confirmed that non-Qubes Whonix 18.2.4.3 includes the fix and is available to download.

An older image can have received newer packages. Check the installed APT version in each relevant environment rather than treating the original image filename as its current patch status. Whonix 17 is out of security support.

What HTTPS and Tor protect

Qubes says its Debian and Whonix repositories use HTTPS by default. This blocks the ordinary interception route available against plain HTTP. It does not remove the threat from an attacker-controlled repository server or an independently compromised authentication mechanism.

Whonix's discussion makes a separate point about Tor: routing updates through Tor makes targeting a specific user harder. It does not repair APT's file handling. Encryption in transit, anonymity and package verification protect different parts of an update.

Why templates matter to Monero wallets

Qubes' template model lets several qubes share their underlying operating-system files. A compromised template can affect the application and service qubes based on it, including wallet environments and privacy gateways.

Malicious software inherited by a wallet qube could inspect information available to that environment or change the wallet program. That is a consequence of operating-system compromise, not evidence that anyone has stolen Monero keys through this flaw. Keeping a wallet in a separate qube does not make a compromised parent template trustworthy.

This issue is separate from the recent Xen isolation vulnerabilities. QSB-122 does not describe an escape through the hypervisor.

Qubes patches and repository availability

For Qubes 4.3, QSB-122 names two packages for dom0, the administrative domain: qubes-core-dom0-linux 4.3.25 and qubes-mgmt-salt-dom0-update 4.3.4. They change how the update tools install the APT fix.

At 14:47 UTC on November 6, the official stable repository metadata lacked both fixes. The security-testing metadata included them. QSB-122 anticipates migration to stable over two weeks. Debian's APT fixes and Qubes' updater fixes have separate release schedules.

Qubes reserves testing repositories for advanced users and warns against relying on testing code for critical work. Check the installed versions before assuming the updater contains these fixes.

How to update Qubes safely

Use the Qubes Update tool, which handles the ordering. For command-line updates, QSB-122 requires updating dom0 alone first. Do not directly run APT to update affected qubes.

In a dom0 terminal, begin with:

sudo qubes-dom0-update

Check the installed updater versions in dom0 before proceeding:

rpm -q qubes-core-dom0-linux qubes-mgmt-salt-dom0-update

If the required fixes are missing, the QSB-122 remediation is incomplete. Then use qubes-vm-update from dom0 to update every Debian and Whonix template and standalone. Include both Whonix Gateway and Workstation templates, plus any custom copies. Follow the official update instructions and inspect the results for skipped or failed updates.

After updating, inspect APT inside each relevant template or standalone with this read-only command:

dpkg-query -W apt

Compare the result with the fixed version for its Debian release. Save your work, shut down updated templates and restart all affected qubes. Running children need a restart to use their template's updated system files.

What remains unconfirmed

The reviewed Debian, APT, Qubes and Whonix disclosures do not report observed exploitation or compromised Monero wallets. A vulnerable package alone cannot establish whether an attack occurred. Installing a fix closes the documented weakness. It does not prove that an already compromised environment is clean.