As with most things in InfoSec it depends.
If you Linux systems is a thin client terminal e.g. a Igel technologies device running their Ubuntu derivative, and you've configured your VDI securely, locked down USB port etc, then since their is nowhere for malware to reside other than in memory (the devices don't have user writable local storage) then you'd been reasonable safe to not run AV. You'll be running a very small risk that malware could create a hidden writable storage partition on the device and therefore survive a reboot, but in most environments this should be within risk tolerance.
Similarly if you're running Linux in a VM, say for development/experiementation, and you're willing to delete that VM entirely if infected, then not running antimalware is probably also within risk tolerance for most environments.
As for server based Linux, I'd consider your security control environment more fully rather than look at AV in isolation, as a point solution. So you need to make the decision holistically looking at your architecture and the other defenses in place. So for example, if your Linux box was behind a gateway that proxied connections to it are inspected traffic for malware and other attack signatures, was fully patched, was segmented from other more critical systems, runs a host firewall and maybe even HIDS and you have SIEM to monitor for anamolies and a good CSIRP, then you may consider than sufficient protection, but it'll all depend on your assessment of the risks.
-----------------------------------------------------------
Steve Wilme CISSP-ISSAP, ISSMP MCIIS
