diff --git a/etc/default/grub.d/40_enable_iommu.cfg b/etc/default/grub.d/40_enable_iommu.cfg
new file mode 100644
index 0000000..8e2baff
--- /dev/null
+++ b/etc/default/grub.d/40_enable_iommu.cfg
@@ -0,0 +1,2 @@
+# Enables IOMMU to prevent DMA attacks.
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX intel_iommu=on amd_iommu=on"