@TaylorRCampbell Your answer is incredible! Not only does it answer the question, but Adiantum is already available on my Linux laptop, ready to be used, I don't even have to install anything. Someone just had to tell me about it (because cryptsetup benchmark does not show all the useful ciphers by default). And adiantum is strictly more secure than AES-XTS because a single ciphertext bit flip randomizes the entire disk sector.
On my old Core i3 CPU @ 2.53GHz I have these benchmarks with
for ci in xchacha12,aes-adiantum-plain64 xchacha20,aes-adiantum-plain64 aes-xts-plain64; cryptsetup benchmark -c $ci; end (output edited for readability)
# Tests are approximate using memory only (no storage IO).
# Algorithm | Key | Encryption | Decryption
xchacha12,aes-adiantum 256b 532,5 MiB/s 538,9 MiB/s
xchacha20,aes-adiantum 256b 441,2 MiB/s 447,0 MiB/s
aes-xts 256b 124,7 MiB/s 125,2 MiB/s
On my more modern Core i7 @ 2.70 GHz: (highest numbers from multiple runs)
# Tests are approximate using memory only (no storage IO).
# Algorithm | Key | Encryption | Decryption
xchacha12,aes-adiantum 256b 1066,9 MiB/s 1107,6 MiB/s
xchacha20,aes-adiantum 256b 935,8 MiB/s 951,5 MiB/s
aes-xts 256b 2189,9 MiB/s 2213,3 MiB/s
(For anyone considering using adiantum for disk encryption, the xchacha20 variant uses more rounds for the chacha cipher and thus has more of a security margin. It is recommended unless you absolutely can't tolerate its performance over the xchacha12 variant, e.g. on a smartwatch. Currently both are secure, but new discoveries in cryptanalysis would potentially break xchacha12 earlier if it ever came to that.)
Now I also want to use adiantum with AES instead of ChaCha on my newer computers for the better security it gives. Guess I'll need to ask on unix.stackexchange about that, as aes-ctr,aes-adiantum-plain64 or something similar doesn't seem to exist in my kernel yet.
edit: The hardware accelerated version of a wide block cipher also exists, it's called HCTR2, and is available in Linux kernel 6. Thanks @PaulCrowley!