Is this attack vector possible?
I would say it is possible because there is no 100% secure software. In this specific case you are using Evince which is using the poppler PDF library which had several security problems in the past and there is the chance that there are some unknown vulnerabilities either in evince or in poppler or the libc library etc. And while you probably did this as an unprivileged user there were privilege escalation attacks in the past in Linux and there will be probably more in the future. And once the attacker has access to the kernel space there is not much which will protect against full permanent system compromise, which might also include your downloads, downloaded keys for verification of downloads etc.
But a VM would not have fully protected you too because there were bugs in the past in XEN, VirtualBox, KVM/QEMU etc, i.e. every virtualization software.
How can I scan my linux machine for spyware?
While I think that this attack is possible in theory I very much doubt that it can be easily done. Which means that this attack could only be done by a very knowledgeable attacker who will probably also be able to bypass any spyware scans, because such scans only employ some heuristics and can be tricked.
If you feel that your system is compromised in such a deep way you must be very paranoid. But if you deal with secrets some government or criminal organisations are very much interested in this paranoia might be justified. In this situation your only choice would probably be to throw away your existing system and get a new one. But remember, that the new system might also be compromised already by the vendor or gets compromised during delivery or that that data you restore from backup might already be compromised from earlier infection or that your router might be infected etc.
There is no such thing as 100% security and you have to find out for yourself how valuable your data or systems might be and how probable it is for you to be a victim of very targeted and expensive attacks. And if you just opened the typical PDF malware which uses bugs in Acrobat Reader then you are probably safe because it is highly unlikely that these attacks work against Evince too.
I had all last updates and installed and my linux was everytime updated.
While it helps to have the latest updates you should understand that updates are often done because security problems where found. And often these security issues are used in exploits before the update gets released, i.e. often the update is only done because some new exploits where found in the wild which used previously unknown bugs. Thus having the updates only fixes against the problems which are already known and fixed and not against the unknown or unfixed problems.