A prefix length says how many leading bits of the address identify the network, and the rest identify the host. A block of n host bits has 2^n addresses, but in a normal subnet the all-zeros and all-ones host values are reserved, so 2^n - 2 are usable. CIDR replaced the fixed class sizes with prefixes of any length, which lets many small networks be announced as one aggregate route.
Prefix, mask and address count
RFC 4632 gives the example of the old Class B network 172.16.0.0 with mask 255.255.0.0. Written as a prefix it is 172.16.0.0/16: the first 16 bits are ones in the mask and the last 16 are zeros.
RFC 1878 tabulates the common masks: /24 is 255.255.255.0 with 256 addresses, /25 is .128 with 128, /26 is .192 with 64, /27 is .224 with 32, /28 is .240 with 16, /29 is .248 with 8, and /30 is .252 with 4.
RFC 1122 says addresses may not have the value 0 or all ones in the host field, apart from special cases. The all-ones host value is the subnet's directed broadcast. So a /26 such as 192.168.10.0/26 has 64 addresses: .0 is the network, .63 is the broadcast, and .1 to .62 are the 62 usable hosts.
Sizing subnets with VLSM
Variable length subnet masking gives each subnet the smallest block that fits. Work from the host count: find the smallest n where 2^n - 2 covers it, then the prefix is 32 - n.
Example: a segment needs 31 hosts. A /27 has 32 addresses but only 30 usable, one short. A /26 has 62 usable, so the segment gets a /26.
Example: a router-to-router link needs two addresses. A /30 (255.255.255.252) has 4 addresses and 2 usable, one for each router. RFC 4632's table also labels a /31 a "p2p link", but when the network and broadcast addresses are reserved, a two-host link needs a /30.
Why CIDR exists
Before CIDR only three network sizes existed. RFC 4632 says classless prefixes can describe any power-of-two block from one address to 2^32 addresses. With classless prefixes you can no longer infer the mask from the first bits of the address, so routing must carry the prefix length.
Aggregation is the payoff. An end site numbered from its provider's space needs no route of its own: the provider advertises a single aggregate route for the larger block, and that one route reaches every customer in it. Forwarding then works on a longest-match basis.
Where the exam catches people
Believing a /27 fits 31 hosts: it has 32 addresses but only 30 usable, so 31 hosts need a /26.
Believing 255.255.255.248 is the mask for a two-host link: that is a /29 with 6 usable hosts. Two usable hosts is /30, 255.255.255.252.
Believing VLSM is what lets a provider announce one route for many customers: that is CIDR aggregation. VLSM sizes subnets inside one network.
Believing the mask can still be read from the first octet: with classless prefixes the prefix length must be carried explicitly.