What CIDR notation actually encodes
A CIDR prefix like /26 means the first 26 bits of the 32-bit IPv4 address are the "network" portion, and the remaining 6 bits are the "host" portion available for addressing individual devices. The subnet mask is just this same information written as an IP-address-shaped number: /26 corresponds to 255.255.255.192, because setting the first 26 bits to 1 and the rest to 0 works out to that value.
How the network and broadcast addresses are derived
The network address is found by a bitwise AND of the IP address and the subnet mask — this zeroes out the host bits, leaving only the network portion. The broadcast address is the network address with all host bits set to 1 instead of 0 (found via a bitwise OR with the "wildcard mask," which is just the subnet mask inverted bit-for-bit). Both are reserved addresses within the subnet — the network address identifies the subnet itself, and the broadcast address is used to reach every host in it at once — so neither is assignable to an individual device.
A worked example — the same IP at three different prefix lengths
Take 192.168.1.10 at /24: subnet mask 255.255.255.0, network address 192.168.1.0, broadcast address 192.168.1.255, usable host range 192.168.1.1 to 192.168.1.254 (254 usable hosts). The same IP at /26: subnet mask 255.255.255.192, network address 192.168.1.0, broadcast address 192.168.1.63, usable range 192.168.1.1 to 192.168.1.62 (62 usable hosts). At /30 (a common size for point-to-point router links): subnet mask 255.255.255.252, network address 192.168.1.8, broadcast address 192.168.1.11, usable range 192.168.1.9 to 192.168.1.10 (2 usable hosts).
Notice the network address itself changes between /24 and /30 for the identical starting IP (192.168.1.0 vs 192.168.1.8) — a smaller subnet (larger prefix number) doesn't just shrink the host range within the same network, it can place the address in an entirely different, smaller network boundary.
The two special cases — /31 and /32
A /32 prefix has zero host bits: the network, broadcast, first-usable, and last-usable addresses are all identical to the IP itself (usable host count of exactly 1) — this is used to identify a single specific host, e.g. in routing tables. A /31 prefix has just one host bit, which would normally leave no usable addresses under the standard network/broadcast reservation rule — RFC 3021 carves out a special exception allowing both addresses in a /31 to be used as a 2-host point-to-point link, which is why /31 shows 2 usable hosts despite having only 2 total addresses.
Why usable host count follows a power-of-two pattern
Usable host count = 2^(32 − prefix length) − 2 for any prefix from /1 through /30 — the "− 2" subtracts the reserved network and broadcast addresses. This is why host counts jump in powers of two as the prefix shrinks by one: /24 gives 254 usable hosts, /23 gives 510, /25 gives 126, and so on — halving or doubling with every single bit of prefix change.