Documentation was updated just now. The part which answers your question is quoted below at the time of writing but users should read if from the up to date version going to and going from there:
It is quoted here for convenience, for easier quoting from it and discussion.
These instructions are for Debian buster
, which is recommended. Other Debian releases might work, but this is untested. In that case, replace buster
with the actual codename your release.
Note: this applies to Whonix 15
. Later Whonix versions may use a codename different to buster
.
Package virtualbox
should be installed from Debian unstable (codename: sid
). This is non-ideal but required since VirtualBox in unavailable in Debian buster
/ buster-backports
at the time of writing. It has risks such as bricking the apt package manager. Therefore users should make sure to have their backup and restore process functional. Alternativly you could install from Oracle Repository but this comes with different risks.
(Edit: scratch outdated information.)
What makes you conclude that?