Resolve ‘Hash Sum mismatch’ on Ubuntu apt-get update in WSL2

Troubleshoot and fix 'Hash Sum mismatch' errors during apt-get update in Ubuntu on Windows WSL2. Learn to clear repository cache and resolve common update failures.

When managing Ubuntu or Debian distributions within Windows Subsystem for Linux 2 (WSL2), encountering a "Hash Sum mismatch" error during an apt-get update operation is a relatively common, yet frustrating, issue. This error typically indicates that the package index files downloaded by apt do not match their expected checksums, suggesting a data integrity problem. This guide will walk you through diagnosing and resolving this specific caching and integrity error in your WSL2 environment.

Symptom & Error Signature

Users will typically observe this error when running sudo apt update or sudo apt-get update in their WSL2 Ubuntu terminal. The command will fail, often after downloading some repository data, and display output similar to the following:

Err:1 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages
  Hash Sum mismatch
  Hashes of expected file:
   - Filesize: 887010 B [weak]
   - SHA256: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
   - MD5Sum: fedcba9876543210fedcba9876543210
  Hashes of received file:
   - SHA256: zyxwvutsrqponmlkjihgfedcba9876543210abcdef0123456789abcdef01
   - MD5Sum: 0123456789abcdef0123456789abcdef
  Last-Update: Mon, 19 Oct 2026 10:00:00 UTC
  Release file created at: Mon, 19 Oct 2026 10:00:00 UTC
E: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/binary-amd64/Packages.gz  Hash Sum mismatch
   Hashes of expected file:
    - Filesize: 887010 B [weak]
    - SHA256: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
    - MD5Sum: fedcba9876543210fedcba9876543210
   Hashes of received file:
    - SHA256: zyxwvutsrqponmlkjihgfedcba9876543210abcdef0123456789abcdef01
    - MD5Sum: 0123456789abcdef0123456789abcdef
   Last-Update: Mon, 19 Oct 2026 10:00:00 UTC
   Release file created at: Mon, 19 Oct 2026 10:00:00 UTC
E: Some index files failed to download. They have been ignored, or old ones used instead.

Root Cause Analysis

The "Hash Sum mismatch" error fundamentally means that the integrity of one or more downloaded package index files (Packages.gz, Release, Release.gpg, etc.) has been compromised. apt relies on cryptographic hashes to verify that the files it downloads are authentic and untampered. When the calculated hash of a downloaded file does not match the hash provided in the repository's Release file, this error occurs.

Several factors can contribute to this in a WSL2 environment:

1. Corrupted Local apt Cache: This is the most common cause. Partially downloaded files, stale index files, or inconsistencies within apt's local cache (/var/lib/apt/lists/) can lead to mismatches. apt might attempt to use outdated metadata or partially downloaded data.
2. Network Instability or Interference:
   • WSL2 Network Virtualization: WSL2 operates with its own lightweight virtual machine and a virtual network adapter managed by Windows. Intermittent network connectivity, packet loss, or corruption between the WSL2 instance and the internet (or local proxy) can lead to incomplete or corrupted downloads.
   • Windows Host Network Issues: Underlying issues with the host Windows machine's network connection, VPN, or firewall can indirectly affect WSL2's ability to fetch data cleanly.
   • Proxy/MITM: If a transparent proxy, corporate firewall, or a Man-in-the-Middle (MITM) proxy is inspecting or modifying HTTP/HTTPS traffic, it can alter the downloaded data, causing checksum mismatches.
3. Out-of-Sync Repository Mirrors: While less common for official Ubuntu archives, if you are using a custom or geographically local mirror, it might be temporarily out of sync with the main repository. This means the Release file might list hashes for newer packages, but the package files themselves haven't been replicated yet.
4. Hardware Issues (Rare): Extremely rare, but faulty RAM or storage on the host machine could theoretically cause data corruption during download or caching.

Step-by-Step Resolution

Here's a structured approach to resolve the apt-get update Hash Sum mismatch error in WSL2, progressing from the most common and easiest fixes to more involved troubleshooting.

1. Clear the Local APT Cache and Downloaded Lists

This is the first and often most effective step, addressing common cache corruption.

# Clean the local repository of retrieved package files
sudo apt clean

# Remove all package lists from /var/lib/apt/lists/
# This forces apt to download fresh lists on the next update
sudo rm -rf /var/lib/apt/lists/*

# Attempt to update again
sudo apt update

The sudo rm -rf /var/lib/apt/lists/* command will delete all cached package lists. This is generally safe and necessary for this error, but ensure you understand its purpose. apt will re-download these lists on the next update command.

2. Change APT Repository Mirrors

If the issue persists, the currently configured mirror might be out of sync or experiencing network issues. Switching to a different mirror can resolve this.

1. Backup your current sources.list:

   sudo cp /etc/apt/sources.list /etc/apt/sources.list.backup
   

2. Edit sources.list: Open the file using nano or your preferred editor.

   sudo nano /etc/apt/sources.list
   

3. Replace Mirror Address: Look for lines starting with deb and deb-src. You'll typically see http://archive.ubuntu.com/ubuntu or a country-specific mirror like http://us.archive.ubuntu.com/ubuntu.

   • Option A: Use the global archive.ubuntu.com: If you're currently using a country-specific mirror, try switching to the main global one.
   • Option B: Use mirrors.kernel.org or ftp.debian.org (for Debian): These are reliable alternative mirrors.
   • Option C: Use a different country-specific mirror: If you were already on archive.ubuntu.com, you might try a specific country mirror, e.g., http://us.archive.ubuntu.com/ubuntu.

   Example change (for Ubuntu):

   -deb http://archive.ubuntu.com/ubuntu/ focal main restricted universe multiverse
   +deb http://us.archive.ubuntu.com/ubuntu/ focal main restricted universe multiverse
   # OR for a more generic one if you were on a country-specific one already
   # deb http://archive.ubuntu.com/ubuntu/ focal main restricted universe multiverse
   

   Save and exit (Ctrl+X, then Y, then Enter for nano).

4. Clear cache and update again:

   sudo apt clean
   sudo rm -rf /var/lib/apt/lists/*
   sudo apt update
   

3. Disable IPv6 (Temporary Workaround)

Sometimes, network stacks or specific mirrors have issues with IPv6. Temporarily disabling it might bypass the problem.

1. Edit apt configuration to prefer IPv4:

   sudo nano /etc/apt/apt.conf.d/99force-ipv4
   

2. Add the following line:

   Acquire::ForceIPv4 "true";
   

   Save and exit.

3. Clear cache and update:

   sudo apt clean
   sudo rm -rf /var/lib/apt/lists/*
   sudo apt update
   

If this resolves the issue, you might have a deeper IPv6 configuration problem on your Windows host or network. You can either keep this setting or investigate further.

4. Check for Proxy Interference

If you are behind a corporate network or have manually configured a proxy on your Windows host, it might be interfering.

1. Check WSL2 proxy settings: Look for proxy environment variables:

   env | grep -i proxy
   

   Also check apt's own proxy configuration:

   cat /etc/apt/apt.conf /etc/apt/apt.conf.d/* | grep -i proxy
   

2. If a proxy is configured (e.g., HTTP_PROXY, HTTPS_PROXY): Try temporarily unsetting them for the update:

   sudo -E apt update # -E preserves existing environment variables
   # OR unset manually
   unset HTTP_PROXY
   unset HTTPS_PROXY
   sudo apt update
   

   If apt itself is configured to use a proxy, you might need to temporarily comment out or remove the relevant lines in /etc/apt/apt.conf or /etc/apt/apt.conf.d/ files.

Disabling or bypassing corporate proxies might violate network policies. Only proceed if you understand the implications and have permission. If a proxy is required, consult your network administrator for proper configuration.

5. Reset WSL2 Network (if all else fails)

If the problem persists and you suspect underlying WSL2 network issues, a more drastic step is to reset the WSL2 network configuration. This involves shutting down WSL2 and potentially refreshing its internal virtual switch.

1. Shut down all WSL2 instances from Windows PowerShell (Admin):

   wsl --shutdown
   

2. Optional: Restart the Host Networking Services (Windows PowerShell Admin): This can sometimes clear transient network issues on the Windows host that affect WSL2.

   Restart-Service -Name "Host Network Service"
   Restart-Service -Name "LxssManager" # The Windows Subsystem for Linux Manager
   

3. Restart your WSL2 distribution: Open your Ubuntu terminal again. This will restart the WSL2 VM.

4. Clear apt cache and update:

   sudo apt clean
   sudo rm -rf /var/lib/apt/lists/*
   sudo apt update
   

The wsl --shutdown command will terminate all running WSL2 distributions and any processes within them. Ensure you save your work before executing this command.

By systematically applying these steps, you should be able to resolve the "Hash Sum mismatch" error and restore normal apt-get update functionality in your WSL2 Ubuntu environment.