diff --git a/grub2/edit_auth_ifc.go b/grub2/edit_auth_ifc.go
index db3407b53..42f293a33 100644
--- a/grub2/edit_auth_ifc.go
+++ b/grub2/edit_auth_ifc.go
@@ -6,6 +6,7 @@ package grub2
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 	"unicode"
 
@@ -18,6 +19,10 @@ const (
 	editAuthDBusInterface = dbusInterface + ".EditAuthentication"
 )
 
+// pbkdf2HashReg 用于校验 grub 编辑认证密码的 PBKDF2 哈希格式：
+// grub.pbkdf2.sha<alg>.<iterations>.<salt>.<hash>
+var pbkdf2HashReg = regexp.MustCompile(`^grub\.pbkdf2\.sha\d+\.\d+\.[0-9A-Fa-f]+\.[0-9A-Fa-f]+$`)
+
 func (e *EditAuth) GetInterfaceName() string {
 	return editAuthDBusInterface
 }
@@ -37,6 +42,10 @@ func (e *EditAuth) Enable(sender dbus.Sender, username, password string) *dbus.E
 		return dbusutil.ToError(fmt.Errorf("username or password invalid"))
 	}
 
+	if !pbkdf2HashReg.MatchString(password) {
+		return dbusutil.ToError(fmt.Errorf("invalid pbkdf2 hash format"))
+	}
+
 	err = e.setGrubEditShellAuth(username, password)
 	if err != nil {
 		return dbusutil.ToError(err)
diff --git a/grub2/modify_manger.go b/grub2/modify_manger.go
index ec1187160..13273af01 100644
--- a/grub2/modify_manger.go
+++ b/grub2/modify_manger.go
@@ -162,8 +162,7 @@ func (m *modifyManager) runUpdateGrubWithUnit() error {
 	var command []string
 	path, err := exec.LookPath(updateGrubCmd)
 	if err != nil {
-		path = grubMkconfigCmd
-		command = append(command, updateGrubCmd, "-o", grubScriptFile)
+		command = append(command, grubMkconfigCmd, "-o", grubScriptFile)
 	} else {
 		command = append(command, path)
 	}