diff --git a/salt/grains/core.py b/salt/grains/core.py
index <HASH>..<HASH> 100644
--- a/salt/grains/core.py
+++ b/salt/grains/core.py
@@ -165,7 +165,7 @@ def _linux_gpu_data():
 
     devs = []
     try:
-        lspci_out = __salt__['cmd.run']('lspci -vmm')
+        lspci_out = __salt__['cmd.run']('{0} -vmm'.format(lspci))
 
         cur_dev = {}
         error = False
@@ -510,7 +510,7 @@ def _virtual(osdata):
         if not cmd:
             continue
 
-        cmd = '{0} {1}'.format(command, ' '.join(args))
+        cmd = '{0} {1}'.format(cmd, ' '.join(args))
 
         ret = __salt__['cmd.run_all'](cmd)
Use path found by salt.utils.which

I ran into this problem running `salt-ssh '*' test.ping` with a
XenServer <I> node as the target. Even though the `lspci` and
`dmidecode` (after I installed it) commands are found by
`salt.utils.which`, because they're not actually in the `$PATH`, they
fail to execute.